Add pinned container builds and Wolfskin release signing

docker/release-tag.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Add one lightweight release marker without publishing it.
+set -euo pipefail
+if [[ -n $(git status --porcelain) ]]; then
+    printf 'Commit or discard checkout changes before tagging a release.\n' >&2
+    exit 1
+fi
+base="pwolfskin-$(date -u +%Y_%m_%d)"
+tag=$base
+sequence=1
+while git show-ref --verify --quiet "refs/tags/$tag"; do
+    tag="${base}_${sequence}"
+    sequence=$((sequence + 1))
+done
+git tag "$tag"
+printf 'Created %s locally; no tag was pushed.\n' "$tag"
+printf 'versionName: %s\n' "$(git describe --tags --long --match='v*' | cut -c 2-)"
+printf 'versionCode: %s\n' "$(git tag --list 'v*' 'p*' | wc -l)"