ci(release): validate maintenance release prior publishing it (#109)

Author: Djaytan

.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
     branches: [ main, '+.x', next, next-major, beta, alpha ]
   schedule:
     - cron: '16 5 * * *' # Every day at 05:16 UTC
+  workflow_call: { } # Typically for validating maintenance releases prior publishing them
 
 permissions: { }
 

.github/workflows/release.yml

@@ -116,15 +116,25 @@ jobs:
         working-directory: .github/semantic-release/
         run: npx --no-install semantic-release
 
+  maintenance-validate:
+    name: On Maintenance - Validate
+    uses: ./github/workflows/ci.yml
+
   release-on-maintenance:
-    name: On Maintenance
+    name: On Maintenance - Perform
     runs-on: ubuntu-24.04
     timeout-minutes: 15
 
     # This job is triggered by the schedule or workflow_dispatch events
     # and only runs on the default branch (i.e., main).
     if: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && github.ref_name == 'main' }}
 
+    # Validate Docker image first
+    needs: maintenance-validate
+
+    permissions:
+      contents: read
+
     steps:
       # Firewall rules:
       # -> "*.github.com": Standard interactions with GitHub