fix: harden major-tag update (release: published) (#135)

* fix: trigger major-tag update on tag push instead of release published

The release: published event is suppressed by GITHUB_TOKEN anti-recursion
when a release is published by automation, which left v8 stuck on v8.3.7
after the v8.3.8 release (build-image.yaml@v8 then lacked the timeoutMinutes
input, breaking kubernetes.yaml@v8.3.8 consumers).

Trigger on the semver tag push instead (created only on publish, never on
drafts), derive the version from the pushed ref, and add a workflow_dispatch
recovery lever to realign the major tag manually.

* fix: use glob tag filter and guard against tag deletions

Address review feedback:
- on.push.tags uses glob syntax, not regex; v[0-9]+.[0-9]+.[0-9]+ required a
  literal '+' and would never match v8.3.8. Use v[0-9]*.[0-9]*.[0-9]* and
  enforce the exact vX.Y.Z shape in the script (also skips pre-releases).
- push fires on tag deletion too; add a job-level guard so it only runs on
  tag creation or manual dispatch.

* chore: trim comments to incident-critical notes only

* fix: harden release-published major-tag update

Keep release: published (releases are created manually by a human, so the
GITHUB_TOKEN suppression does not apply), but harden the weak parts:
- take the version from github.event.release.tag_name instead of fragile
  git describe topology guessing
- enforce strict vX.Y.Z semver and skip pre-releases
- add workflow_dispatch recovery lever to realign the major tag by hand
- idempotent git tag -f + force-push instead of delete-then-recreate

* chore: add tag trigger to the pipeline

---------

Co-authored-by: Andreas Beuge <andreasbeuge@abs-bmbp.fritz.box>

Author: jmpalomares

.github/workflows/ci.update-major-version-tag.yaml

@@ -1,12 +1,25 @@
 name: Update major tag
 on:
+  # `release: published` is suppressed when the release is published by the default GITHUB_TOKEN — publish releases as a human (or PAT), never via GITHUB_TOKEN, or v8 silently lags behind.
   release:
     types:
       - published
+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Semver tag to align the major tag to (e.g. v8.3.8)"
+        required: true
+
+permissions:
+  contents: write
 
 jobs:
   update-major-tag:
     runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' || github.event.release.prerelease == false }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -15,22 +28,21 @@ jobs:
       - name: Extract major version
         id: version
         run: |
-          # Get the latest tag created by the release job
-          TAG_NAME="$(git describe --tags --abbrev=0)"
-          echo "Retrieved tag: $TAG_NAME"
-          # Extract major version (e.g., v8.2.7 -> v8)
+          TAG_NAME="${{ github.event.inputs.tag || github.event.release.tag_name || github.ref_name }}"
+          echo "Resolved tag: $TAG_NAME"
+          if [[ ! "$TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::notice::'$TAG_NAME' is not a release semver tag (vX.Y.Z); skipping major-tag update."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           MAJOR_VERSION="$(echo "$TAG_NAME" | sed -E 's/^v([0-9]+)\..*/v\1/')"
           echo "major_version=$MAJOR_VERSION" >> "$GITHUB_OUTPUT"
           echo "full_version=$TAG_NAME" >> "$GITHUB_OUTPUT"
       - name: Update major version tag
+        if: ${{ steps.version.outputs.skip != 'true' }}
         run: |
           git config user.name "parcellab-dev-bot"
           git config user.email "dev.bot@parcellab.com"
 
-          # Delete existing major version tag if it exists
-          git tag -d "${{ steps.version.outputs.major_version }}" || true
-          git push -d origin "${{ steps.version.outputs.major_version }}" || true
-
-          # Create new major version tag pointing to the same commit as the full version
-          git tag "${{ steps.version.outputs.major_version }}"
-          git push origin tag "${{ steps.version.outputs.major_version }}"
+          git tag -f "${{ steps.version.outputs.major_version }}" "${{ steps.version.outputs.full_version }}"
+          git push origin -f "refs/tags/${{ steps.version.outputs.major_version }}"