fix: only mark releases as latest

.github/workflows/docker-publish.yml

@@ -62,7 +62,7 @@ jobs:
           IMAGE="ghcr.io/${{ github.repository }}"
 
           if [[ "${{ steps.check-release.outputs.is_release }}" == "true" ]]; then
-            # This is a release: use semver tags
+            # This is a release: use semver tags + latest
             TAG="${{ steps.check-release.outputs.release_tag }}"
             VERSION="${TAG#v}"
             MAJOR=$(echo "$VERSION" | cut -d. -f1)
@@ -70,9 +70,9 @@ jobs:
             TAGS="${VERSION},${MAJOR}.${MINOR},${MAJOR},latest"
             echo "Building RELEASE with tags: $TAGS"
           else
-            # Regular commit: use SHA tags
+            # Regular commit: use SHA tags only (no latest)
             SHORT_SHA="${GITHUB_SHA:0:7}"
-            TAGS="sha-${SHORT_SHA},latest"
+            TAGS="sha-${SHORT_SHA}"
             echo "Building COMMIT with tags: $TAGS"
           fi
           echo "tags=$TAGS" >> $GITHUB_OUTPUT
@@ -158,7 +158,7 @@ jobs:
 
   # Merge platform-specific images into multi-arch manifest
   merge:
-    needs: [prepare, build]
+    needs: [ prepare, build ]
     runs-on: ubuntu-latest
     permissions:
       contents: read