Make release workflow dispatch-driven

Invert the release process by switching the trigger from `push: tags` to
`workflow_dispatch`. Previously, a developer would push a tag to trigger the
release build. This could lead to a tag existing for a failed build. With this
change, the workflow is triggered manually. It builds and pushes the Docker
images first. Only after the multi-arch manifest is successfully created does a
final job run to create the GitHub Release and the associated tag, making
tagging a byproduct of a successful release.

Author: sevein

.github/workflows/release.yml

@@ -1,14 +1,10 @@
 name: Release
 
 on:
-  push:
-    tags:
-      # Example: 1.1.21.3
-      - '\d+\.\d+\.\d+\.\d+'
   workflow_dispatch:
     inputs:
       version:
-        description: 'Release version (e.g. 1.1.21.3)'
+        description: 'Release version (e.g. 1.1.21.4)'
         required: true
         type: string
 
@@ -31,11 +27,19 @@ jobs:
       - name: Check out the repository
         uses: actions/checkout@v4
 
-      - name: Prepare
+      - name: Check version format
+        run: |
+          VERSION="${{ github.event.inputs.version }}"
+          if [[ ! "$VERSION" =~ ^\d+\.\d+\.\d+(\.\d+)?$ ]]; then
+            echo "Invalid version format: $VERSION"
+            exit 1
+          fi
+          echo "Version format OK: $VERSION"
+
+      - name: Derive platform pair
         run: |
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-          echo "VERSION=${{ github.event.inputs.version || github.ref_name }}" >> $GITHUB_ENV
 
       - name: Docker meta
         id: meta
@@ -56,8 +60,8 @@ jobs:
         id: build
         uses: docker/build-push-action@v6
         with:
-          context: ${{ env.VERSION }}
-          file: ${{ env.VERSION }}/Dockerfile
+          context: ${{ github.event.inputs.version }}
+          file: ${{ github.event.inputs.version }}/Dockerfile
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           tags: ${{ env.REGISTRY_IMAGE }}
@@ -98,18 +102,14 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Prepare
-        run: |
-          echo "VERSION=${{ github.event.inputs.version || github.ref_name }}" >> $GITHUB_ENV
-
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY_IMAGE }}
           tags: |
-            ${{ env.VERSION }}-alpine
-            ${{ env.VERSION }}
+            ${{ github.event.inputs.version }}-alpine
+            ${{ github.event.inputs.version }}
             latest
 
       - name: Create manifest list and push
@@ -120,4 +120,21 @@ jobs:
 
       - name: Inspect image
         run: |
-          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
+          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ github.event.inputs.version }}-alpine
+
+  release:
+    runs-on: ubuntu-latest
+    needs: merge
+    permissions:
+      contents: write
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create release and tag with gh
+        run: gh release create "$VERSION" --title "$VERSION"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ github.event.inputs.version }}