ci: prevent double image build upon release [skip ci]

.github/workflows/docker-images.yml

@@ -9,9 +9,32 @@ env:
   REGISTRY: ghcr.io
 
 jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Retrieve tags
+        run: git fetch --depth=1 origin +refs/tags/*:refs/tags/*
+
+      - name: Set output variables
+        id: check
+        run: |
+          tag=""
+          if [[ "${{ github.ref }}" == refs/heads/* ]]; then
+            tag="$(git tag --points-at HEAD)"
+          fi
+          echo "head_tag=${tag}" >> $GITHUB_OUTPUT
+
+    outputs:
+      head_tag: ${{ steps.check.outputs.head_tag }}
+
   build-docker:
     name: Build and attest Docker image with JIB
     runs-on: ubuntu-latest
+    needs: [ prepare ]
+    if: "github.event_name == 'push' && needs.prepare.outputs.head_tag == ''"
 
     permissions:
       contents: read
@@ -67,7 +90,6 @@ jobs:
     name: Update staging image tag
     runs-on: ubuntu-latest
     needs: [ build-docker ]
-    if: "!startsWith(github.ref, 'refs/tags/v')"
 
     steps:
       - name: Checkout