[frogggias]

Adds automated versioning and GitHub releases while keeping :latest on every push to main.

What changes

• .releaserc.json: semantic-release on main with the conventionalcommits preset (so feat!: / BREAKING CHANGE: → major, feat → minor, fix/perf → patch, other types → no release). Only the commit-analyzer, release-notes-generator and github plugins: nothing is committed back to main (its ruleset blocks direct pushes), and the github plugin's PR/issue comments and labels are off, so the job only needs contents: write.
• publish.yml:
  • build still pushes :latest on every push to main (and ci-bokvi), and now exposes the pushed digest.
  • New release job (needs: build, main only, serialized by a concurrency group): runs semantic-release, which creates the vX.Y.Z tag and GitHub release, then tags the same digest as :X.Y.Z and :sha-<short> with buildx imagetools create, without rebuilding.
  • The tags: ['v*'] trigger is removed: a tag pushed with GITHUB_TOKEN starts no workflow, so the versioned image is tagged in the release job. v* tags are no longer pushed by hand.
• README / CONTRIBUTING: the tag table, the publishing steps and the release process describe the automated flow.

semantic-release packages are pinned in the workflow, like commitlint in lint.yml. conventional-changelog-conventionalcommits stays on 9.x: 10.x needs conventional-changelog-writer@9, but @semantic-release/release-notes-generator@14 ships writer 8. The dry run below failed in generateNotes with 10.4.1.

Assumptions

• "Keep latest" means :latest stays on every push to main, as before. Versioned tags come in addition.
• There are no tags yet, so merging this PR releases v1.0.0, semantic-release's first version, with the two existing feat commits in its notes.
• Not added: floating :X / :X.Y tags, and docs-git's release-guard action. Dotykacka/docs-git is private, so a bokvi workflow can't use it, and this repo has no release/* branches.

Proof

There's no UI to screenshot before merge. This is a semantic-release dry run of this branch (--dry-run --no-ci --branches ci/semantic-release) with the pinned packages:

[semantic-release] › ✔  Allowed to push to the Git repository
[semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/github"
[semantic-release] › ℹ  No previous release found, retrieving all commits
[semantic-release] › ℹ  Found 5 commits since last release
[semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analysis of 5 commits complete: minor release
[semantic-release] › ℹ  There is no previous release, the next release version is 1.0.0
[semantic-release] › ⚠  Skip v1.0.0 tag creation in dry-run mode
[semantic-release] › ✔  Published release 1.0.0 on default channel
[semantic-release] › ℹ  Release note for version 1.0.0:
## 1.0.0 (2026-10-14)

### Features

    * add runner image with libatomic1 for node.js 25+ (eb25d60)
    * install node.js 24 into the runner tool cache (#2) (61cc3ba), closes bokvi/id#159

actionlint .github/workflows/publish.yml passes. Screenshots of the v1.0.0 release and the :1.0.0 package tag will be added after the merge run.

[frogggias]

Superseded by the PR from ci/semantic-release-versions: a follow-up commit here failed commitlint's header length, and the branch can't be force-pushed, so the change moved to a clean single-commit branch.