Add gated Docker publishing to release workflow

.github/workflows/release.yml

@@ -114,3 +114,59 @@ jobs:
         run: |
           rm -rf /tmp/.buildx-cache
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
+  publish-docker-images:
+    needs: build-and-release
+    runs-on: ubuntu-latest
+    environment: keep-production  # Requires release-admin team approval
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Resolve versions
+        run: |
+          echo "version=$(git describe --tags --match 'v[0-9]*' HEAD)" >> $GITHUB_ENV
+          echo "revision=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-docker-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-docker-
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and Push Docker Images
+        uses: docker/build-push-action@v5
+        with:
+          target: runtime-docker
+          tags: |
+            keepnetwork/keep-client:latest
+            keepnetwork/keep-client:${{ env.version }}
+            keepnetwork/keep-client:mainnet
+          labels: |
+            version=${{ env.version }}
+            revision=${{ env.revision }}
+          build-args: |
+            ENVIRONMENT=mainnet
+            VERSION=${{ env.version }}
+            REVISION=${{ env.revision }}
+          push: true
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-docker-new
+          context: .
+
+      - name: Move Docker cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-docker-new /tmp/.buildx-cache