ci: publish main Docker images only from stable release tags

.github/workflows/docker-publish.yml

@@ -3,8 +3,10 @@ name: Publish Docker Image
 on:
   push:
     branches:
-      - main
       - dev
+    tags:
+      - "[0-9]*.[0-9]*.[0-9]*"
+      - "v[0-9]*.[0-9]*.[0-9]*"
   workflow_dispatch:
     inputs:
       image_repository:
@@ -50,6 +52,12 @@ jobs:
           version="$(python -m setuptools_scm)"
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
+      - name: Validate release channel
+        id: release_channel
+        env:
+          PACKAGE_VERSION: ${{ steps.package_version.outputs.version }}
+        run: bash scripts/docker-release-channel.sh
+
       - name: Log in to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -77,7 +85,7 @@ jobs:
         with:
           images: ${{ steps.image_repo.outputs.image_repository }}
           tags: |
-            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=main,enable=${{ steps.release_channel.outputs.channel == 'main' }}
             type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
             type=raw,value=v${{ steps.package_version.outputs.version }}
             type=sha,format=short
@@ -99,10 +107,10 @@ jobs:
       - name: Notify Home Assistant add-on repository
         if: >-
           github.repository == 'openhop-dev/openhop_repeater' &&
-          (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
+          (steps.release_channel.outputs.channel == 'main' || steps.release_channel.outputs.channel == 'dev')
         env:
           DISPATCH_TOKEN: ${{ secrets.HA_ADDON_REPO_DISPATCH_TOKEN }}
-          CHANNEL: ${{ github.ref_name }}
+          CHANNEL: ${{ steps.release_channel.outputs.channel }}
           REVISION: ${{ github.sha }}
         run: |
           if [ -z "${DISPATCH_TOKEN}" ]; then