Build and publish container / build (pull_request) Successful in 4m16s
The login step referenced PACKAGES_SECRET while the secret configured on this repository -- and on its sibling -- is PACKAGES_TOKEN. The expression resolved to an empty string and docker/login-action failed with "Password required", so the first release published nothing and created no tag. The push trigger only fires on image-affecting paths, which a workflow-only change is not, so merging this fix alone would not produce a release. workflow_dispatch can now cut one, restricted to main so a manual run on another branch cannot tag a commit that is not on the default branch. Verified by running the version step across every event and ref combination: push and workflow_dispatch on main release, everything else does not. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>