fix(ci): never claim :latest on a manual docker-publish run

[Flix6x]

Problem

docker-publish.yml decides whether to also push lfenergy/flexmeasures:latest with:

if [ "${{ github.event.release.prerelease }}" != "true" ]; then

github.event.release.prerelease only exists on the release webhook payload. On workflow_dispatch there is no release payload, so the expression renders as an empty string, [ "" != "true" ] is true, and the run pushes :latest alongside the requested tag — silently overwriting the stable image with whatever was manually built.

That makes the manual-dispatch path documented in release_process.rst unsafe for anything but a stable release.

Fix

• Gate the latest tag on github.event_name == 'release', so a dispatch never claims it implicitly.
• Add an opt-in latest boolean input (default false) so the documented "re-run a stable release" path still works.
• Document both in release_process.rst, including the easy-to-miss detail that workflow_dispatch reads the workflow file from the ref picked in the "Use workflow from" dropdown, while the tag input decides which ref is checked out and built.

Behaviour

event	prerelease	latest input	pushed tags
release	false	—	:v0.33.1 + :latest
release	true	—	:v0.34.0rc1
workflow_dispatch	n/a	unticked	:v0.34.0rc1
workflow_dispatch	n/a	ticked	:v0.33.1 + :latest

Before this change, row 3 also pushed :latest.

Context

Found while preparing a pre-release image for a downstream plugin, which needs exactly the dispatch path in row 3.

🤖 Generated with Claude Code

[read-the-docs-community]

Documentation build overview

📚 flexmeasures | 🛠️ Build #33585564 | 📁 Comparing d7eb1a9 against latest (c35554a)

  🔍 Preview build  

3 files changed

± changelog.html
± api/v3_0.html
± dev/release_process.html