feat(release): require versioned locked publication

.github/workflows/publish-image.yml

@@ -2,8 +2,6 @@ name: Publish verified container image
 
 on:
   push:
-    branches:
-      - main
     tags:
       - "v*"
 
@@ -16,6 +14,17 @@ jobs:
     permissions:
       contents: read
     steps:
+      - name: Reject non-version publication events
+        env:
+          PUBLICATION_EVENT: ${{ github.event_name }}
+          PUBLICATION_REF: ${{ github.ref }}
+        run: |
+          if [[ "${PUBLICATION_EVENT}" != "push" \
+             || ! "${PUBLICATION_REF}" =~ ^refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "publication requires a strict vX.Y.Z tag push" >&2
+            exit 1
+          fi
+
       - name: Check out exact source commit
         uses: actions/checkout@v4
         with:
@@ -127,4 +136,5 @@ jobs:
             --image-id tested-image/trex-core-image.id \
             --local-image "trex-core-ci:${GITHUB_SHA}" \
             --commit "${GITHUB_SHA}" \
+            --event-name "${GITHUB_EVENT_NAME}" \
             --ref "${GITHUB_REF}"