- on: release (published), not on any v* tag: only a deliberate release builds an image; the version is its tag without the v, plus latest. - docker/login-action, setup-buildx and build-push-action, as the runner already serves them for inlaw_outlaw; the version as a build argument and image label. - Comments on why the registry needs a personal token (the job token's empty package scope) and that packages belong to the repository owner. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE