Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Stefan Bethke 189105075c fix: Publishes images only from main ... Every pushed ref built and pushed images, with the tag derived from the ref name. A branch named "latest" or a git tag named "main" therefore overwrote the production image, and ref names were interpolated into shell scripts unquoted (script injection). - images are only pushed for pushes to refs/heads/main - other refs are built and tested with a ci-<sha> tag, never pushed - registry login happens only when publishing, after the compose test - main additionally pushes an immutable sha-<sha> tag for pinning - expression values are passed to scripts via env The registry credentials still need to be restricted to main on the Forgejo side, since a pushed branch can modify this workflow.		2026-11-15 11:36:49 +01:00
..
workflows	fix: Publishes images only from main	2026-11-15 11:36:49 +01:00