fix(build): tag images by version and major.minor instead of latest (#632)

Every v* tag pushed :latest, so a patch released on an older line or
a pre-release tag would move it backwards. Rather than making :latest
smarter, drop it: before 1.0 every minor is allowed to break
compatibility, so a floating latest silently carries consumers across
compatibility boundaries. A moving {{major}}.{{minor}} tag lands
exactly on that boundary in 0.x and serves the same purpose.

Tags now come from docker/metadata-action with {{version}} and
{{major}}.{{minor}}. flavor: latest=false is required because the
action would otherwise add latest on its own, its default being
latest=auto. Nothing has to consult the rest of the tag history: a
patch published on an older line moves only its own line, and
pre-releases only ever extend {{version}}, never a moving tag.

The labels output is wired through as well, since
org.opencontainers.image.source is what links the GHCR package back
to this repository.

Note that {{version}} strips the v prefix, so images are tagged
:0.3.0 rather than :v0.3.0. No release has been cut since #631, so
nothing already published is affected.

Signed-off-by: YR Chen <stevapple@icloud.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: stevapple

.github/workflows/release.yaml

@@ -153,6 +153,16 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Extract image metadata
+      id: meta
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302    # v6.2.0
+      with:
+        images: ghcr.io/${{ github.repository }}
+        flavor: latest=false
+        tags: |
+          type=semver,pattern={{version}}
+          type=semver,pattern={{major}}.{{minor}}
+
     - name: Build and push image
       uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a    # v7.3.0
       with:
@@ -163,9 +173,8 @@ jobs:
         build-args: |
           GITVERSION=${{ github.ref_name }}
           GITCOMMIT=${{ steps.vars.outputs.commit }}
-        tags: |
-          ghcr.io/${{ github.repository }}:${{ github.ref_name }}
-          ghcr.io/${{ github.repository }}:latest
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
 
   create-release:
     needs: release