feat: update

skills/builder/scripts/publish_docker.sh

@@ -16,7 +16,7 @@ usage() {
 # Environment:
 #   DOCKER_REGISTRY      Required (or --registry)
 #   DOCKER_REPOSITORY    Optional, default: git repository name (or --repository)
-#   IMAGE_TAG            Optional, default: git describe --tags --always --dirty (or --tag)
+#   IMAGE_TAG            Optional, default: version.sh --docker (or --tag)
 #   PLATFORMS            Optional, default: linux/amd64 (or --platform)
 #   DOCKER_DOCKERFILE    Optional, default: Dockerfile (--file)
 #   DOCKER_CONTEXT       Optional, default: . (--context)
@@ -89,19 +89,37 @@ if [[ -z "$repository" || "$repository" == /* || "$repository" == */ || "$reposi
   echo "Error: repository must be namespace/name without leading or trailing slash: $repository" >&2
   exit 2
 fi
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+version_sh=$script_dir/version.sh
+
 if [[ -z "$tag" ]]; then
-  if [[ -n "$project_root" ]]; then
-    tag=$(git -C "$project_root" describe --tags --always --dirty 2>/dev/null) || tag=
+  if [[ ! -x "$version_sh" ]]; then
+    echo "Error: version.sh not found next to publish_docker.sh: $version_sh" >&2
+    exit 2
   fi
-  if [[ -z "$tag" ]]; then
+  if [[ -z "$project_root" ]]; then
     echo "Error: IMAGE_TAG (or --tag) is required outside a git repository." >&2
     exit 2
   fi
+  tag=$("$version_sh" -C "$project_root" --docker) || {
+    echo "Error: failed to derive IMAGE_TAG from Git ancestry." >&2
+    exit 2
+  }
 fi
 if [[ "$tag" == *:* || "$tag" == */* ]]; then
   echo "Error: tag must not contain : or /: $tag" >&2
   exit 2
 fi
+# Official-shaped tags (X.Y.Z or vX.Y.Z) are only legal on that exact Git tag.
+if [[ "$tag" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ && -x "$version_sh" && -n "$project_root" ]]; then
+  derived=$("$version_sh" -C "$project_root" --docker) || true
+  expected=${tag#v}
+  if [[ "$derived" != "$expected" ]]; then
+    echo "Error: IMAGE_TAG $tag looks official but HEAD is $derived" >&2
+    echo "Official X.Y.Z is allowed only when HEAD exact-matches vX.Y.Z." >&2
+    exit 2
+  fi
+fi
 if [[ "$tag" == latest && ${ALLOW_LATEST:-0} != 1 && "$mode" == push ]]; then
   echo "Error: refusing to publish floating tag 'latest'; pass an explicit version." >&2
   echo "Set ALLOW_LATEST=1 only when the user explicitly asked for 'latest'." >&2