feat: publish latest Docker tag on release

[Copilot]

Docker images were published to GHCR with semver and SHA tags only — no latest tag, making docker pull ghcr.io/abapify/adt-cli:latest fail.

Change

Added latest to the docker/metadata-action tag list in .github/workflows/docker.yml, enabled conditionally:

type=raw,value=latest,enable=${{ inputs.version != '' || startsWith(github.ref, 'refs/tags/') }}

• Applies when called from the release workflow (via inputs.version)
• Applies when workflow_dispatch is triggered on a git tag
• No-ops for branch-based manual runs

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

Review Summary by Qodo

Add latest Docker tag for release publications

✨ Enhancement

Walkthroughs

Description

• Add latest Docker tag to GHCR image publications
• Enable conditionally for releases and git tags
• Allows docker pull ghcr.io/abapify/adt-cli:latest to work

Diagram

flowchart LR
  A["Docker Metadata Action"] -->|"Add latest tag"| B["Conditional Enable"]
  B -->|"inputs.version OR git tag"| C["GHCR Image Tags"]
  C -->|"semver + sha + latest"| D["Published Image"]

Loading

File Changes

1. .github/workflows/docker.yml ✨ Enhancement +1/-0

Add conditional latest Docker tag to metadata

• Added type=raw,value=latest tag to docker metadata configuration
• Enabled conditionally when inputs.version is provided or git ref is a tag
• Ensures latest tag is published only for releases, not branch builds

.github/workflows/docker.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Implicit inputs.version semantics 🐞 Bug ⛯ Reliability

Description

The new latest enablement relies on inputs.version even though workflow_dispatch doesn’t
declare a version input, making the condition’s behavior dependent on implicit GitHub Actions
input-defaulting behavior and harder to reason about/maintain. This is low risk today but increases
the chance of accidental latest publication (or disabling it) if the workflow triggers/inputs are
refactored later.

Code

.github/workflows/docker.yml[44]

+            type=raw,value=latest,enable=${{ inputs.version != '' || startsWith(github.ref, 'refs/tags/') }}

Evidence

docker.yml defines version only under workflow_call, but the workflow is also directly
workflow_dispatch-able with no declared inputs. Despite that, it references inputs.version
(existing behavior for checkout, and now also for enabling latest). The only in-repo caller
(release.yml) passes version, so the new tag will work there; the remaining ambiguity is
specifically around the direct workflow_dispatch path and future maintainability.

.github/workflows/docker.yml[3-11]
.github/workflows/docker.yml[20-24]
.github/workflows/docker.yml[35-45]
.github/workflows/release.yml[126-133]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow uses `inputs.version` to decide whether to publish the `latest` Docker tag, but `version` is only declared under `workflow_call` while the workflow is also runnable via `workflow_dispatch` without declared inputs. This relies on implicit behavior and is easy to misinterpret or break during future edits.

### Issue Context
The release workflow calls `docker.yml` via `workflow_call` and passes `version`, so the new behavior works for releases. The concern is primarily clarity/robustness for direct `workflow_dispatch` runs and future maintenance.

### Fix Focus Areas
- .github/workflows/docker.yml[3-11]
- .github/workflows/docker.yml[40-44]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 8eb4cf1

Command	Status	Duration	Result
nx affected -t lint test build e2e-ci --verbose...	✅ Succeeded	<1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-03-02 21:11:30 UTC