Refactor workflows to use automatic tag triggers

Remove manual tag inputs from publish and bump workflows.
Instead, trigger on git tags automatically and use github.ref_name
to reference the current tag. Add matrix testing across multiple
Rust versions and Linux distributions.

Author: nerjs

.github/workflows/bump-and-release.yml

@@ -11,10 +11,6 @@ on:
           - minor
           - major
         default: patch
-      ref:
-        description: "Branch or commit to tag"
-        type: string
-        default: master
       beta:
         description: "Append -beta.N suffix"
         type: boolean
@@ -39,7 +35,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ inputs.ref }}
           token: ${{ secrets.RELEASE_TOKEN }}
           fetch-depth: 0
 
@@ -93,7 +88,7 @@ jobs:
         run: |
           TAG="v${{ steps.ver.outputs.next }}"
           git tag -a "$TAG" -m "$TAG"
-          git push origin "${{ inputs.ref }}" --follow-tags
+          git push origin "${{ github.ref_name }}" --follow-tags
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
   release:

.github/workflows/ci.yml

@@ -35,11 +35,51 @@ jobs:
 
   test:
     needs: clippy
+    strategy:
+      fail-fast: false
+      matrix:
+        rust: [stable, beta]
+        env:
+          - name: ubuntu
+            container: ""
+          - name: debian
+            container: "debian:12"
+          - name: arch
+            container: "archlinux:latest"
+          - name: alpine
+            container: "rust:1-alpine"
+    name: test (${{ matrix.env.name }} / ${{ matrix.rust }})
     runs-on: ubuntu-latest
+    container: ${{ matrix.env.container }}
     steps:
+      - name: Prep (debian)
+        if: matrix.env.name == 'debian'
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates build-essential pkg-config libssl-dev
+
+      - name: Prep (arch)
+        if: matrix.env.name == 'arch'
+        run: |
+          pacman -Syu --noconfirm git curl base-devel openssl pkgconf
+
+      - name: Prep (alpine)
+        if: matrix.env.name == 'alpine'
+        shell: sh
+        run: |
+          apk add --no-cache git curl ca-certificates bash nodejs musl-dev
+
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.rust }}
+
       - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ matrix.env.name }}-${{ matrix.rust }}
+
       - run: cargo test --all-features
 
   build:

.github/workflows/publish-crates.yml

@@ -3,23 +3,17 @@ name: Publish (crates.io)
 on:
   workflow_dispatch:
     inputs:
-      tag:
-        description: "Tag to publish (e.g. v1.2.3)"
-        type: string
-        required: true
       dry_run:
         description: "Run cargo publish --dry-run"
         type: boolean
         default: false
 
 jobs:
   publish:
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: refs/tags/${{ inputs.tag }}
-
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
 

.github/workflows/publish-docker-hub.yml

@@ -3,22 +3,17 @@ name: Publish (Docker Hub)
 on:
   workflow_dispatch:
     inputs:
-      tag:
-        description: "Tag to publish (e.g. v1.2.3)"
-        type: string
-        required: true
       image:
         description: "Image name (namespace/name)"
         type: string
         required: true
 
 jobs:
   publish:
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: refs/tags/${{ inputs.tag }}
 
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
@@ -31,8 +26,8 @@ jobs:
         with:
           images: ${{ inputs.image }}
           tags: |
-            type=raw,value=${{ inputs.tag }}
-            type=raw,value=latest,enable=${{ !contains(inputs.tag, '-beta') }}
+            type=raw,value=${{ github.ref_name }}
+            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') }}
 
       - uses: docker/build-push-action@v5
         with:

.github/workflows/publish-ghcr.yml

@@ -2,23 +2,17 @@ name: Publish (GHCR)
 
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: "Tag to publish (e.g. v1.2.3)"
-        type: string
-        required: true
 
 permissions:
   contents: read
   packages: write
 
 jobs:
   publish:
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: refs/tags/${{ inputs.tag }}
 
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
@@ -32,8 +26,8 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=${{ inputs.tag }}
-            type=raw,value=latest,enable=${{ !contains(inputs.tag, '-beta') }}
+            type=raw,value=${{ github.ref_name }}
+            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') }}
 
       - uses: docker/build-push-action@v5
         with: