ci: only push Docker image on main branch, use :latest tag

Build always runs for validation, but push only happens on main.
IaC updated to pull :latest tag which main branch publishes.

Author: chrisns

.github/workflows/docker-build.yml

@@ -70,7 +70,7 @@ jobs:
         with:
           context: cloudformation/scenarios/localgov-drupal
           file: cloudformation/scenarios/localgov-drupal/docker/Dockerfile
-          push: ${{ github.event_name != 'pull_request' && (github.event.inputs.push_image != 'false') }}
+          push: ${{ github.ref == 'refs/heads/main' && github.event.inputs.push_image != 'false' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha

cloudformation/scenarios/localgov-drupal/cdk/lib/constructs/compute.ts

@@ -275,7 +275,7 @@ export class ComputeConstruct extends Construct {
 
     // Add container - pull from GitHub Container Registry
     const container = taskDefinition.addContainer('drupal', {
-      image: ecs.ContainerImage.fromRegistry('ghcr.io/co-cddo/ndx_try_aws_scenarios-localgov_drupal:fix-menu-links-search-index'),
+      image: ecs.ContainerImage.fromRegistry('ghcr.io/co-cddo/ndx_try_aws_scenarios-localgov_drupal:latest'),
       logging: ecs.LogDrivers.awsLogs({
         logGroup: this.logGroup,
         streamPrefix: 'drupal',