Merge pull request 'Publish only a latest image tag' (#15) from latest-tag-only into main

Reviewed-on: #15
Reviewed-by: branderson <brad@branderson.io>

.gitea/workflows/images.yml

@@ -10,7 +10,6 @@ name: Images
 on:
   push:
     branches: [main]
-    tags: ['v*.*.*']
   workflow_dispatch:
 
 # Jobs that run docker builds use dejima-privileged; anything else should use
@@ -59,6 +58,12 @@ jobs:
           echo "host=$host" >> "$GITHUB_OUTPUT"
           echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
 
+      # Shown in Settings, since images carry no version number
+      - name: Name the version
+        id: version
+        shell: bash
+        run: echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v3
@@ -71,11 +76,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ steps.registry.outputs.host }}/${{ steps.registry.outputs.owner }}/${{ matrix.image }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=ref,event=branch
+          tags: type=raw,value=latest
 
       - uses: docker/build-push-action@v6
         with:
@@ -85,5 +86,5 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64
           build-args: |
-            VERSION=${{ steps.meta.outputs.version }}
+            VERSION=${{ steps.version.outputs.sha }}
           provenance: false

.github/workflows/images.yml

@@ -7,7 +7,6 @@ name: Images
 on:
   push:
     branches: [main]
-    tags: ['v*.*.*']
   workflow_dispatch:
 
 permissions:
@@ -39,6 +38,12 @@ jobs:
         shell: bash
         run: echo "name=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
 
+      # Shown in Settings, since images carry no version number
+      - name: Name the version
+        id: version
+        shell: bash
+        run: echo "sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v3
@@ -51,11 +56,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ steps.owner.outputs.name }}/${{ matrix.image }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=ref,event=branch
+          tags: type=raw,value=latest
 
       - uses: docker/build-push-action@v6
         with:
@@ -65,5 +66,5 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64
           build-args: |
-            VERSION=${{ steps.meta.outputs.version }}
+            VERSION=${{ steps.version.outputs.sha }}
           provenance: false

docs/09-deployment/docker-deployment.md

@@ -29,13 +29,11 @@ All three are built from this repository by `docker compose up -d --build`.
 ### Prebuilt images
 
 Images are published to GitHub's container registry. To pull them instead of
-building, set `IMAGE_PREFIX` in `.env`, ending in `/`, and optionally
-`IMAGE_TAG`. `latest` is the newest release, `1.2` the newest of a minor
-version, and `main` follows the `main` branch.
+building, set `IMAGE_PREFIX` in `.env`, ending in `/`. There's one tag,
+`latest`, built from the tip of `main`.
 
 ```sh
 IMAGE_PREFIX=ghcr.io/branderson/
-IMAGE_TAG=latest
 ```
 
 Then run `docker compose pull && docker compose up -d`. Images from another
@@ -53,8 +51,7 @@ Two workflows build the same images with the same tags:
 
 `.gitea/workflows/images.yml` builds all three images on Gitea Actions and
 pushes them to the Gitea instance's container registry, under the repository's
-owner. Pushes to `main` publish a `main` tag; `v1.2.3` tags publish `1.2.3`,
-`1.2` and `latest`. Its jobs run docker builds, so they need a runner labelled
+owner. Each push to `main` publishes `latest`. Its jobs run docker builds, so they need a runner labelled
 `dejima-privileged`; jobs that don't build images should use `dejima-confined`.
 It also needs a repository secret, `REGISTRY_TOKEN`: an access token with
 package write access, belonging to the repository's owner, whom the workflow