Publish the docker image to Docker Hub + GHCR on release

Same pattern as sigennut (built and debugged there first): a
workflow_call target release.yml invokes directly as a second job in
the same run, not via the release event (GITHUB_TOKEN-authored events
don't trigger other workflows), plus workflow_dispatch for backfilling
already-tagged versions. Multi-arch (linux/amd64,linux/arm64) --
python:3.12-slim and every dependency in requirements.txt already ship
aarch64 wheels, so this should build meaningfully faster than
sigennut's autotools-from-source image did under QEMU.

Needs the DOCKERHUB_USERNAME/DOCKERHUB_TOKEN repo secrets (already
added). GHCR needs no secret -- uses GITHUB_TOKEN.

Author: miklosbagi

.github/workflows/docker-publish.yml

@@ -0,0 +1,66 @@
+name: Docker publish
+
+# Called directly from release.yml as a second job in the *same*
+# workflow run (workflow_call), not triggered by the release event
+# itself -- GitHub's anti-recursion rule means events performed with
+# the default GITHUB_TOKEN (which release.yml uses to create the
+# release) never trigger other workflows, confirmed empirically in
+# sigennut before this repo got the same fix.
+#
+# workflow_dispatch lets this be re-run by hand for any already-tagged
+# version, e.g. to backfill a release that predates this workflow:
+#   gh workflow run docker-publish.yml -f version=0.1.0
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to build and push (must match an existing git tag)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.version }}
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            miklosbagi/invforge:${{ inputs.version }}
+            miklosbagi/invforge:latest
+            ghcr.io/miklosbagi/invforge:${{ inputs.version }}
+            ghcr.io/miklosbagi/invforge:latest

.github/workflows/release.yml

@@ -16,11 +16,15 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 jobs:
   tag-and-release:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    outputs:
+      new_version: ${{ steps.version.outputs.new_version }}
+      skip: ${{ steps.bump.outputs.skip }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -81,3 +85,11 @@ jobs:
             --target "${{ github.event.pull_request.merge_commit_sha }}" \
             --title "${{ steps.version.outputs.new_version }}" \
             --generate-notes
+
+  docker-publish:
+    needs: tag-and-release
+    if: needs.tag-and-release.outputs.skip != 'true'
+    uses: ./.github/workflows/docker-publish.yml
+    with:
+      version: ${{ needs.tag-and-release.outputs.new_version }}
+    secrets: inherit