fix: correct release workflow dependencies and SBOM artifact handling

- Add build-image as dependency to generate-sbom job (needs image digest)
- Add build-image as dependency to deploy-docs job (references build-image outputs)
- Add build-distributions as dependency to publish-release-assets (needs dist artifacts)
- Make SBOM artifact download conditional in publish-release-assets (only when generate-sbom succeeded)

This fixes the workflow failure on push to next where SBOM generation is skipped for prereleases but publish-release-assets tries to download non-existent SBOM artifacts.

Co-authored-by: pvliesdonk <22190282+pvliesdonk@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yaml

@@ -453,11 +453,12 @@ jobs:
 
   generate-sbom:
     name: Generate SBOM
-    needs: release
+    needs: [release, build-image]
     # Only generate SBOM for stable releases, not pre-releases
     if: |
       always() &&
       needs.release.result == 'success' &&
+      needs.build-image.result == 'success' &&
       needs.release.outputs.new_tag != '' &&
       needs.release.outputs.is_prerelease == 'false'
     runs-on: ubuntu-latest
@@ -500,11 +501,12 @@ jobs:
 
   publish-release-assets:
     name: Publish Release Assets (GitHub Release only)
-    needs: [release, build-image, generate-sbom]
+    needs: [release, build-image, build-distributions, generate-sbom]
     if: |
       always() &&
       needs.release.result == 'success' &&
       needs.build-image.result == 'success' &&
+      needs.build-distributions.result == 'success' &&
       (needs.generate-sbom.result == 'success' || needs.generate-sbom.result == 'skipped') &&
       needs.release.outputs.released == 'true' &&
       needs.release.outputs.new_tag != ''
@@ -527,6 +529,7 @@ jobs:
           path: ./artifacts/e2e
 
       - name: Download SBOM artifacts
+        if: needs.generate-sbom.result == 'success'
         uses: actions/download-artifact@v4
         with:
           name: sbom-reports
@@ -596,11 +599,12 @@ jobs:
 
   deploy-docs:
     name: Deploy Documentation (Pages)
-    needs: release
+    needs: [release, build-image]
     # Only deploy docs for stable releases, not pre-releases
     if: |
       always() &&
       needs.release.result == 'success' &&
+      needs.build-image.result == 'success' &&
       needs.release.outputs.new_tag != '' &&
       needs.release.outputs.is_prerelease == 'false'
     runs-on: ubuntu-latest