From cfac7b08e0e03e7571ea59409ffd3c8b6d1b1c6b Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Sun, 14 Jun 2026 02:24:46 -0700
Subject: [PATCH 1/2] ci: publish docker image on push to main

---
 .github/workflows/docker_publish.yaml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker_publish.yaml b/.github/workflows/docker_publish.yaml
index a7ab50b0..08a28e57 100644
--- a/.github/workflows/docker_publish.yaml
+++ b/.github/workflows/docker_publish.yaml
@@ -1,6 +1,8 @@
 name: Publish Docker Image
 
 on:
+  push:
+    branches: [main]
   workflow_dispatch:
     inputs:
       tags:
@@ -15,6 +17,9 @@ permissions:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
+  # On push to main, inputs.tags is empty, so fall back to "latest" so the
+  # latest tag tracks main. Manual dispatch still honors custom tags.
+  TAGS_INPUT: ${{ inputs.tags || 'latest' }}
 
 jobs:
   build-image:
@@ -46,7 +51,7 @@ jobs:
         id: prep
         run: |
           TAGS=""
-          IFS=',' read -ra TAG_ARRAY <<< "${{ inputs.tags }}"
+          IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}"
           for t in "${TAG_ARRAY[@]}"; do
             TAGS="${TAGS}${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${t}-${{ matrix.arch }},"
           done
@@ -84,7 +89,7 @@ jobs:
         env:
           SHORT_SHA: ${{ github.sha }}
         run: |
-          IFS=',' read -ra TAG_ARRAY <<< "${{ inputs.tags }}"
+          IFS=',' read -ra TAG_ARRAY <<< "${TAGS_INPUT}"
           FIRST_TAG="${TAG_ARRAY[0]}"
 
           # Create manifest for first tag with SHA tag

From d53c1c686db5d3ab37435bf73162d565bd3320ab Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Sun, 5 Jul 2026 07:21:01 -0700
Subject: [PATCH 2/2] ci(docker): add concurrency group to serialize latest
 manifest publishes

Concurrent publish runs on main could race and produce a mixed-arch latest
manifest. Adds a concurrency group keyed on workflow + ref with
cancel-in-progress: false so an in-flight multi-arch push is not cut off.
---
 .github/workflows/docker_publish.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/docker_publish.yaml b/.github/workflows/docker_publish.yaml
index 08a28e57..9df1e7e9 100644
--- a/.github/workflows/docker_publish.yaml
+++ b/.github/workflows/docker_publish.yaml
@@ -14,6 +14,10 @@ permissions:
   contents: read
   packages: write
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}