fix(ci): log in to the registry before pushing the release image

.github/workflows/build.yml

@@ -87,6 +87,12 @@ jobs:
         env:
           RELAY_VERSION: ${{ inputs.version }}
         run: ./scripts/build.sh dist
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        if: inputs.publish
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           driver-opts: image=moby/buildkit:v0.34.0@sha256:b059f8d7226d0b326bc871af489a5dddf65e36af4d20d14251b072974d9ee87c
@@ -161,12 +167,6 @@ jobs:
         if: inputs.publish
         with:
           subject-checksums: dist/assets/checksums.txt
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: inputs.publish
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
       - name: Sign the image
         if: inputs.publish
         env:
@@ -197,6 +197,7 @@ jobs:
           out=$(helm push "dist/chart/relay-$VERSION.tgz" "$CHARTS" 2>&1)
           printf '%s\n' "$out"
           digest=$(printf '%s\n' "$out" | sed -n 's/^Digest: //p')
+          [ -n "$digest" ] || { echo "helm push printed no digest"; exit 1; }
           cosign sign --yes "${CHARTS#oci://}/relay@$digest"
           echo "digest=$digest" >> "$GITHUB_OUTPUT"
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2

.github/workflows/release.yml

@@ -3,6 +3,12 @@ name: Release
 on:
   push:
     branches: [canary]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Rebuild and publish the existing release vVERSION, for example 0.1.0.
+        required: true
+        type: string
 
 permissions: {}
 
@@ -13,6 +19,7 @@ concurrency:
 jobs:
   release-please:
     name: Release PR
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -38,22 +45,23 @@ jobs:
   build:
     name: Build
     needs: release-please
-    if: needs.release-please.outputs.created == 'true'
+    if: ${{ !cancelled() && (needs.release-please.outputs.created == 'true' || github.event_name == 'workflow_dispatch') }}
     permissions:
       contents: read
       id-token: write # keyless signing and attestations
       attestations: write # store the attestations
       packages: write # push the image and chart
     uses: $/.github/workflows/build.yml
     with:
-      ref: ${{ needs.release-please.outputs.tag }}
-      version: ${{ needs.release-please.outputs.version }}
+      ref: ${{ needs.release-please.outputs.tag || format('v{0}', inputs.version) }}
+      version: ${{ needs.release-please.outputs.version || inputs.version }}
       publish: true
       artifact: release
 
   publish:
     name: Publish
     needs: [release-please, build]
+    if: ${{ !cancelled() && needs.build.result == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -75,14 +83,14 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          TAG: ${{ needs.release-please.outputs.tag }}
+          TAG: ${{ needs.release-please.outputs.tag || format('v{0}', inputs.version) }}
         run: gh release upload "$TAG" --clobber dist/assets/* dist/sbom/* dist/chart/*
       - name: Record the FIPS module and the image
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-          TAG: ${{ needs.release-please.outputs.tag }}
-          VERSION: ${{ needs.release-please.outputs.version }}
+          TAG: ${{ needs.release-please.outputs.tag || format('v{0}', inputs.version) }}
+          VERSION: ${{ needs.release-please.outputs.version || inputs.version }}
           DIGEST: ${{ needs.build.outputs.image-digest }}
         run: |
           {