Limit nightly GHCR publishing to main pushes

.github/workflows/release.yml

@@ -2,6 +2,8 @@ name: Release
 
 on:
   push:
+    branches:
+      - main
     tags:
       - '[0-9]+.[0-9]+.[0-9]+'
       - '[0-9]+.[0-9]+.[0-9]+-*'
@@ -27,6 +29,7 @@ jobs:
       version: ${{ steps.meta.outputs.version }}
       prerelease: ${{ steps.meta.outputs.prerelease }}
       release_enabled: ${{ steps.meta.outputs.release_enabled }}
+      image_push_enabled: ${{ steps.meta.outputs.image_push_enabled }}
     steps:
       - name: Derive version
         id: meta
@@ -37,12 +40,18 @@ jobs:
           if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
             VERSION="${GITHUB_REF#refs/tags/}"
             RELEASE_ENABLED=true
+            IMAGE_PUSH_ENABLED=true
+          elif [[ "${GITHUB_REF}" == "refs/heads/main" ]]; then
+            VERSION="nightly"
+            RELEASE_ENABLED=false
+            IMAGE_PUSH_ENABLED=true
           else
             VERSION="manual-${GITHUB_SHA::7}"
             RELEASE_ENABLED=false
+            IMAGE_PUSH_ENABLED=false
           fi
 
-          if [[ "$VERSION" == *"-alpha"* || "$VERSION" == *"-beta"* || "$VERSION" == *"-rc"* ]]; then
+          if [[ "$VERSION" == "nightly" || "$VERSION" == *"-alpha"* || "$VERSION" == *"-beta"* || "$VERSION" == *"-rc"* ]]; then
             PRERELEASE=true
           else
             PRERELEASE=false
@@ -51,6 +60,7 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
           echo "release_enabled=$RELEASE_ENABLED" >> "$GITHUB_OUTPUT"
+          echo "image_push_enabled=$IMAGE_PUSH_ENABLED" >> "$GITHUB_OUTPUT"
 
   checks:
     name: Checks
@@ -275,7 +285,7 @@ jobs:
       - uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
-        if: ${{ needs.prepare.outputs.release_enabled == 'true' }}
+        if: ${{ needs.prepare.outputs.image_push_enabled == 'true' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -288,7 +298,8 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=${{ needs.prepare.outputs.version }}
+            type=raw,value=${{ needs.prepare.outputs.version }},enable=${{ needs.prepare.outputs.image_push_enabled == 'true' }}
+            type=sha,prefix=sha-,enable=${{ needs.prepare.outputs.version == 'nightly' }}
             type=raw,value=latest,enable=${{ needs.prepare.outputs.prerelease != 'true' && needs.prepare.outputs.release_enabled == 'true' }}
           labels: |
             org.opencontainers.image.title=telemt
@@ -303,7 +314,7 @@ jobs:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ needs.prepare.outputs.release_enabled == 'true' }}
+          push: ${{ needs.prepare.outputs.image_push_enabled == 'true' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha