fix(release): keep container version selection explicit

.config/mise/tasks/github-actions/publish-container

@@ -12,15 +12,13 @@ tags=()
 if [[ "$GITHUB_REF" == refs/heads/master ]]; then
 	tags+=(ci)
 elif [[ "$GITHUB_REF" =~ ^refs/tags/v([0-9]+)\.([0-9]+)\.([0-9]+)(-[0-9A-Za-z.-]+)?$ ]]; then
-	major=${BASH_REMATCH[1]}
-	minor=${BASH_REMATCH[2]}
 	version=${GITHUB_REF_NAME#v}
 	tags+=("$version")
 
 	if [[ "$version" == *-* ]]; then
 		tags+=(preview)
 	else
-		tags+=("$major.$minor" "$major" stable)
+		tags+=(latest)
 	fi
 else
 	echo "Unsupported image publication ref: $GITHUB_REF" >&2

.config/mise/tasks/github-actions/publish-container-test

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+#MISE description="Verify container tags implied by GitHub refs"
+
+set -euo pipefail
+
+task_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+publish_task="$task_dir/publish-container"
+image=ghcr.io/trogonstack/trogoneventstore
+
+run_publish() {
+	local ref=$1
+	local ref_name=$2
+
+	GITHUB_REF="$ref" \
+		GITHUB_REF_NAME="$ref_name" \
+		IMAGE="$image" \
+		PUBLISH_TASK="$publish_task" \
+		bash -c '
+			docker() {
+				printf "%s\n" "$*"
+			}
+
+			source "$PUBLISH_TASK"
+		'
+}
+
+stable=$(run_publish refs/tags/v0.0.2 v0.0.2)
+expected_stable=$(printf '%s\n' \
+	"tag eventstore $image:0.0.2" \
+	"push $image:0.0.2" \
+	"tag eventstore $image:latest" \
+	"push $image:latest")
+
+if [[ "$stable" != "$expected_stable" ]]; then
+	printf 'Unexpected stable release commands:\n%s\n' "$stable" >&2
+	exit 1
+fi
+
+prerelease=$(run_publish refs/tags/v0.0.3-rc.1 v0.0.3-rc.1)
+expected_prerelease=$(printf '%s\n' \
+	"tag eventstore $image:0.0.3-rc.1" \
+	"push $image:0.0.3-rc.1" \
+	"tag eventstore $image:preview" \
+	"push $image:preview")
+
+if [[ "$prerelease" != "$expected_prerelease" ]]; then
+	printf 'Unexpected prerelease commands:\n%s\n' "$prerelease" >&2
+	exit 1
+fi

.github/workflows/common.yml

@@ -139,6 +139,8 @@ jobs:
           cache: false
       - name: Verify release metadata
         run: mise run --skip-tools release-metadata:check
+      - name: Verify container publication tags
+        run: mise run --skip-tools github-actions:publish-container-test
 
   archive-storage-contract:
     runs-on: ubuntu-latest