feat: release on specific labels

Related to github/github-ospo#105

Only generate a release and new action container images
if our semver related labels (`breaking`, `enhancement`) or
the `release` label are used on a merged pull request.

Changed from push (merge) on main branch to release generation
happening when a pull_request is merged to main branch.

This gives us access to the pull requests labels without having
to make API cals.

Currently we'd still need to label a pull request with `release` if
it is a dependabot or manual pull request related to a CVE or security
fix.

- [x] manually add `vuln` and `release` labels to repository

Signed-off-by: jmeridth <[email protected]>

.github/workflows/release.yml

@@ -3,7 +3,9 @@ name: Release
 
 on:
   workflow_dispatch:
-  push:
+  pull_request:
+    types:
+      - closed
     branches:
       - main
 
@@ -12,6 +14,11 @@ permissions:
 
 jobs:
   create_release:
+    if: |
+      github.event.pull_request.merged == true &&
+      (contains(github.event.pull_request.labels.*.name, 'breaking') ||
+      contains(github.event.pull_request.labels.*.name, 'enhancement') ||
+      contains(github.event.pull_request.labels.*.name, 'release'))
     outputs:
       full-tag: ${{ steps.release-drafter.outputs.tag_name }}
       short-tag: ${{ steps.get_tag_name.outputs.SHORT_TAG }}
@@ -34,6 +41,7 @@ jobs:
           short_tag=$(echo ${{ steps.release-drafter.outputs.tag_name }} | cut -d. -f1)
           echo "SHORT_TAG=$short_tag" >> $GITHUB_OUTPUT
   create_action_images:
+    if: github.event.pull_request.merged == true
     needs: create_release
     runs-on: ubuntu-latest
     permissions:
@@ -66,6 +74,7 @@ jobs:
           provenance: false
           sbom: false
   create_discussion:
+    if: github.event.pull_request.merged == true
     needs: create_release
     runs-on: ubuntu-latest
     permissions: