feat: support manual builds from feature branches

- build.yml: determine image tag from branch (main=stable, other=test-<branch>)
- build.yml: allow push on workflow_dispatch from any branch
- build.yml: only sign images from main branch
- build-installer-iso.yml: add image_tag input (default: stable)

.github/workflows/build-installer-iso.yml

@@ -10,7 +10,6 @@ concurrency:
 env:
   IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
   IMAGE_NAME: "${{ github.event.repository.name }}"
-  DEFAULT_TAG: "stable"
 
 jobs:
   build-iso:
@@ -25,6 +24,17 @@ jobs:
           echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
           echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
 
+      - name: Determine image tag
+        run: |
+          BRANCH="${GITHUB_REF_NAME}"
+          if [[ "$BRANCH" == "main" ]]; then
+            echo "IMAGE_TAG=stable" >> ${GITHUB_ENV}
+          else
+            SANITIZED=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9._-]/-/g' | head -c 50)
+            echo "IMAGE_TAG=test-${SANITIZED}" >> ${GITHUB_ENV}
+          fi
+          echo "Building from tag: ${IMAGE_TAG}"
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
@@ -47,7 +57,7 @@ jobs:
 
       - name: Pull base image
         run: |
-          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
+          sudo podman pull ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
 
       - name: Build ISO
         run: |
@@ -60,7 +70,7 @@ jobs:
             --rootfs btrfs \
             --config /config.toml \
             --output /output/ \
-            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}
+            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
 
       - name: Upload ISO artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7