cgi-italy/insula-processor-launcher ? reverse-engineered prompt

Build me the GitHub Actions workflow for this repo that lets people publish their Earth Observation processors to Insula.

It should take a processor repository URL and a branch, tag, or commit, then clone it, scan it for committed secrets, build the container image from code/Dockerfile, scan the image for high and critical vulnerabilities, publish the scanned image to the platform registry, and create the CWL package with the published image reference filled in. Then publish that CWL as a GitHub Release with a tag like cwl correlation id so it has a stable public URL.

Keep the workflow protected and simple for users, since they should only use the builder CLI and not edit this repo directly. Also make sure the README clearly explains how to trigger a build, what the workflow does, and how the release URL is used to finish deployment on their own machine. If anything about the current setup is missing, add what is needed and look up current GitHub Actions docs online if you need to.