feat(docker): publish next from active release branches (#9181)

Validated in local merge-train T4 (HouMinXi+Zartharas+Andrian+artickc)

scripts/ci/resolve-docker-publish-version.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Resolve the Docker tag/channel for a docker-publish workflow event.
+#
+# Usage:
+#   resolve-docker-publish-version.sh EVENT_NAME REF_TYPE REF_NAME [INPUT_VERSION] [DEFAULT_BRANCH]
+#
+# Outputs exactly one safe tag string:
+# - workflow_dispatch: requested version without a leading v
+# - push tag: tag without a leading v
+# - push main: main
+# - push to the current default release/v* branch: next
+# - release: release tag without a leading v
+set -euo pipefail
+
+EVENT_NAME="${1:?event name required}"
+REF_TYPE="${2:-}"
+REF_NAME="${3:-}"
+INPUT_VERSION="${4:-}"
+DEFAULT_BRANCH="${5:-}"
+
+case "$EVENT_NAME" in
+  workflow_dispatch)
+    VERSION="${INPUT_VERSION#v}"
+    ;;
+  push)
+    if [ "$REF_TYPE" = "tag" ]; then
+      VERSION="${REF_NAME#v}"
+    else
+      case "$REF_NAME" in
+        main)
+          VERSION="main"
+          ;;
+        release/v*)
+          if [ -z "$DEFAULT_BRANCH" ] || [ "$REF_NAME" != "$DEFAULT_BRANCH" ]; then
+            echo "Refusing to publish next from non-default release branch: $REF_NAME" >&2
+            exit 1
+          fi
+          VERSION="next"
+          ;;
+        *)
+          echo "Unsupported Docker publish branch: $REF_NAME" >&2
+          exit 1
+          ;;
+      esac
+    fi
+    ;;
+  release)
+    VERSION="${REF_NAME#v}"
+    ;;
+  *)
+    VERSION="${REF_NAME#v}"
+    ;;
+esac
+
+if ! printf '%s' "$VERSION" | grep -qE '^[A-Za-z0-9._-]+$'; then
+  echo "Refusing to use unsafe VERSION value: $VERSION" >&2
+  exit 1
+fi
+
+printf '%s\n' "$VERSION"

scripts/ci/should-promote-latest.sh

@@ -22,11 +22,13 @@ set -euo pipefail
 
 VERSION="${1:?version required}"
 
-# A pre-release VERSION must never grab :latest (callers already short-circuit
-# this, but stay safe as a standalone unit).
-case "$VERSION" in
-  *-*) echo "false"; exit 0 ;;
-esac
+# Only a stable x.y.z release may ever grab :latest. Floating channels such as
+# `main` and `next`, plus every pre-release identifier, fail closed here even if
+# a caller forgets to short-circuit them first.
+if ! printf '%s' "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+  echo "false"
+  exit 0
+fi
 
 # Build the stable candidate set: incoming tags (v-stripped, pre-releases
 # dropped) plus VERSION itself, then pick the numerically highest.