ci(release): solid release pipeline (GHCR & guarded PyPI)

.github/workflows/release.yml

@@ -1,24 +1,21 @@
 name: release
 on:
   push:
-    tags: ['v*']
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to publish (v*)'
-        required: false
+    tags: ['v*']        # SOLO tags v*
+  workflow_dispatch:    # manual: no publica PyPI si no hay token
 permissions:
   contents: write
   packages: write
 
 jobs:
   build-publish:
+    if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with: { python-version: '3.12' }
-      - name: Build
+      - name: Build sdist/wheel
         run: |
           python -m pip install -U pip build
           python -m build
@@ -32,14 +29,19 @@ jobs:
           password: ${{ secrets.PYPI_API_TOKEN }}
 
   publish-ghcr:
+    if: startsWith(github.ref, 'refs/tags/v')
     needs: build-publish
     runs-on: ubuntu-latest
     permissions: { contents: read, packages: write }
+    env:
+      DOCKER_BUILDKIT: "1"
     steps:
       - uses: actions/checkout@v4
       - name: Compute image name (lowercase)
         shell: bash
         run: echo "IMAGE=ghcr.io/${GITHUB_REPOSITORY@L}" >> "$GITHUB_ENV"
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -48,5 +50,8 @@ jobs:
       - uses: docker/build-push-action@v6
         with:
           context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
           push: true
+          provenance: false
           tags: ${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.ref_name }}