ci: gate production image builds on release tags and add release workflow

Author: raghavyuva

.github/workflows/build-and-push.yml

@@ -7,8 +7,10 @@ name: Build and Push Container
 
 on:
   push:
-    branches:
-      - main
+    tags:
+      - 'v*'
+  release:
+    types: [published]
   workflow_dispatch:
 
 concurrency:
@@ -145,7 +147,9 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
             type=raw,value=latest
-            type=sha,prefix={{branch}}-
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
 
       - name: Create manifest list and push
         if: steps.check.outputs.has_digests == 'true'

.github/workflows/release.yml

@@ -0,0 +1,60 @@
+# Workflow: Release
+# Description: Generates a release tag and GitHub release
+# Why: Provides versioned releases for production deployments
+
+name: Create Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  create-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    outputs:
+      released: ${{ steps.changelog.outputs.skipped == 'false' }}
+      tag: ${{ steps.changelog.outputs.tag }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Conventional Changelog Action
+        id: changelog
+        uses: TriPSs/conventional-changelog-action@v5
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          git-user-name: 'github-actions[bot]'
+          git-user-email: 'github-actions[bot]@users.noreply.github.com'
+          git-message: 'chore(release): {version}'
+          preset: 'angular'
+          tag-prefix: 'v'
+          version-file: 'package.json'
+          skip-on-empty: 'false'
+          skip-ci: 'true'
+          create-summary: 'true'
+          git-push: 'false'
+          release-count: 0
+
+      - name: Commit release artifacts
+        if: ${{ steps.changelog.outputs.skipped == 'false' }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email 'github-actions[bot]@users.noreply.github.com'
+          git add package.json
+          git tag -d "${{ steps.changelog.outputs.tag }}" 2>/dev/null || true
+          git commit -m "chore(release): ${{ steps.changelog.outputs.tag }}"
+          git tag "${{ steps.changelog.outputs.tag }}"
+          git push origin HEAD:main --tags
+
+      - name: Create GitHub Release
+        if: ${{ steps.changelog.outputs.skipped == 'false' }}
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.changelog.outputs.tag }}
+          name: ${{ steps.changelog.outputs.tag }}
+          body: ${{ steps.changelog.outputs.clean_changelog }}
+          prerelease: false