This creates a GitHub release and publishes to Docker Hub and npm
The Docker Hub token must be able to push repositories in the orbitrepos namespace. Configure
the protected release environment with required reviewers so packages and images cannot be
published without approval.
Each image is published with an immutable release version tag and a convenience latest tag.
Production Compose files must pin complete @sha256: image digests from the release's
image-references artifact. Tags, including version tags and latest, are mutable and must not be
used as production deployment inputs.
All packages share the same version number. When any package changes, all versions bump together. This keeps things simple and avoids compatibility issues between packages.