ci: add Docker-only publish dispatch [skip ci]

.github/workflows/docker.yml

@@ -13,9 +13,34 @@ on:
   workflow_dispatch:
     inputs:
       paseo_version:
-        description: "Paseo npm version to build for validation. Defaults to latest."
+        description: "Paseo version to build. Required when publish is true."
         required: false
         default: ""
+      publish:
+        description: "Publish the image to GHCR. Manual publishes require paseo_version."
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
+      source_build:
+        description: "Build from the checked-out source tree instead of npm."
+        required: false
+        default: "auto"
+        type: choice
+        options:
+          - auto
+          - "false"
+          - "true"
+      publish_latest:
+        description: "Also publish ghcr.io/getpaseo/paseo:latest. Ignored for prereleases."
+        required: false
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
 
 concurrency:
   group: docker-${{ github.workflow }}-${{ github.ref }}
@@ -41,6 +66,9 @@ jobs:
       - id: values
         env:
           INPUT_PASEO_VERSION: ${{ inputs.paseo_version }}
+          INPUT_PUBLISH: ${{ inputs.publish }}
+          INPUT_PUBLISH_LATEST: ${{ inputs.publish_latest }}
+          INPUT_SOURCE_BUILD: ${{ inputs.source_build }}
           REPO_OWNER: ${{ github.repository_owner }}
           REF_NAME: ${{ github.ref_name }}
         run: |
@@ -51,6 +79,7 @@ jobs:
           install_version="${INPUT_PASEO_VERSION:-latest}"
           publish=false
           source_build=false
+          publish_latest=false
           prerelease=false
 
           if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
@@ -59,14 +88,49 @@ jobs:
             if [[ "${REF_NAME}" == *-* ]]; then
               prerelease=true
               source_build=true
+            else
+              publish_latest=true
+            fi
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            if [[ "${INPUT_PUBLISH:-false}" == "true" ]]; then
+              if [[ -z "${INPUT_PASEO_VERSION}" || "${INPUT_PASEO_VERSION}" == "latest" ]]; then
+                echo "::error::paseo_version is required for manual Docker publishes."
+                exit 1
+              fi
+              publish=true
+            fi
+
+            if [[ "${install_version}" == *-* ]]; then
+              prerelease=true
+            fi
+
+            case "${INPUT_SOURCE_BUILD:-auto}" in
+              true)
+                source_build=true
+                ;;
+              false)
+                source_build=false
+                ;;
+              auto)
+                if [[ "${prerelease}" == "true" ]]; then
+                  source_build=true
+                fi
+                ;;
+              *)
+                echo "::error::source_build must be auto, true, or false."
+                exit 1
+                ;;
+            esac
+
+            if [[ "${INPUT_PUBLISH_LATEST:-false}" == "true" && "${prerelease}" != "true" ]]; then
+              publish_latest=true
             fi
           fi
 
           check_tag="${image}:check-${GITHUB_SHA::12}"
-          if [[ "${prerelease}" == "true" ]]; then
-            publish_tags="${image}:${install_version}"
-          else
-            publish_tags="${image}:${install_version}"$'\n'"${image}:latest"
+          publish_tags="${image}:${install_version}"
+          if [[ "${publish_latest}" == "true" ]]; then
+            publish_tags="${publish_tags}"$'\n'"${image}:latest"
           fi
 
           {