From 455f4bbd32db3355861bf9bd14ea1b21c3d64def Mon Sep 17 00:00:00 2001 From: Stefan Dej Date: Sun, 6 Sep 2026 12:24:15 +0200 Subject: [PATCH 1/4] fix(docker): prevent unprivileged image from overwriting the latest tag --- .github/workflows/publish_docker.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml index b3f50ecfe7..e3fcdfda84 100644 --- a/.github/workflows/publish_docker.yml +++ b/.github/workflows/publish_docker.yml @@ -42,7 +42,7 @@ jobs: uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: &tags | + tags: | type=edge,branch=develop type=semver,pattern=v{{major}} type=semver,pattern=v{{major}}.{{minor}} @@ -72,7 +72,14 @@ jobs: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} flavor: | suffix=-unprivileged - tags: *tags + latest=false + tags: | + type=edge,branch=develop + type=semver,pattern=v{{major}} + type=semver,pattern=v{{major}}.{{minor}} + type=semver,pattern=v{{major}}.{{minor}}.{{patch}} + type=sha + type=raw,value=latest-unprivileged,enable=${{ github.event_name == 'release' }} - name: Build and push unprivileged Docker image uses: docker/build-push-action@v6 From 026d47f1ce8fc580ebb57a9025b22c485f077f02 Mon Sep 17 00:00:00 2001 From: Stefan Dej Date: Sun, 6 Sep 2026 12:24:44 +0200 Subject: [PATCH 2/4] ci(docker): add workflow file to run the docker build when changing something in it --- .github/workflows/publish_docker.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml index e3fcdfda84..7ce319c3ab 100644 --- a/.github/workflows/publish_docker.yml +++ b/.github/workflows/publish_docker.yml @@ -13,6 +13,7 @@ on: - '.docker/**' - '.dockerignore' - 'Dockerfile' + - '.github/workflows/publish_docker.yml' env: REGISTRY: ghcr.io From 3f88e3eaf65cd623a14cc9ec68cd25dd9908012d Mon Sep 17 00:00:00 2001 From: Stefan Dej Date: Sun, 6 Sep 2026 12:29:42 +0200 Subject: [PATCH 3/4] chore(docker): update github actions in publish_docker workflow --- .github/workflows/publish_docker.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml index 7ce319c3ab..919da81d11 100644 --- a/.github/workflows/publish_docker.yml +++ b/.github/workflows/publish_docker.yml @@ -28,11 +28,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Log in to the Container registry if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -40,7 +40,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -52,13 +52,13 @@ jobs: type=raw,value=latest,enable=${{ github.event_name == 'release' }} - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 push: ${{ github.event_name != 'pull_request' }} @@ -68,7 +68,7 @@ jobs: - name: Extract metadata (tags, labels) for unprivileged Docker id: meta-unprivileged - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} flavor: | @@ -83,7 +83,7 @@ jobs: type=raw,value=latest-unprivileged,enable=${{ github.event_name == 'release' }} - name: Build and push unprivileged Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6 push: ${{ github.event_name != 'pull_request' }} From ee5925275ea9cf50acafdedaffec5b3cdac01fc1 Mon Sep 17 00:00:00 2001 From: Stefan Dej Date: Sun, 6 Sep 2026 12:44:15 +0200 Subject: [PATCH 4/4] refactor: use again the tags link but just use the latest=false to dont overwrite the tag --- .github/workflows/publish_docker.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml index 919da81d11..28d7bfb59d 100644 --- a/.github/workflows/publish_docker.yml +++ b/.github/workflows/publish_docker.yml @@ -43,7 +43,7 @@ jobs: uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | + tags: &tags | type=edge,branch=develop type=semver,pattern=v{{major}} type=semver,pattern=v{{major}}.{{minor}} @@ -74,13 +74,7 @@ jobs: flavor: | suffix=-unprivileged latest=false - tags: | - type=edge,branch=develop - type=semver,pattern=v{{major}} - type=semver,pattern=v{{major}}.{{minor}} - type=semver,pattern=v{{major}}.{{minor}}.{{patch}} - type=sha - type=raw,value=latest-unprivileged,enable=${{ github.event_name == 'release' }} + tags: *tags - name: Build and push unprivileged Docker image uses: docker/build-push-action@v7