Give a pull request build a tag that moves

[indiebrain]

The problem

Every commit on an open branch publishes an image tagged with its own commit sha, and that tag never moves and never expires. Only the newest image of a branch is useful, so the rest are superseded the moment the next commit lands and then stay in the package permanently.

The rate makes it the dominant source of growth. Two to three pull requests are opened a day, but ten to eighteen builds are published a day, so roughly five in six published images are dead on arrival. Each build writes 11 versions: one index, five per-platform manifests, five attestation manifests.

The change

tags: |
  type=semver,pattern={{raw}}
  type=sha,prefix=,suffix=,format=long,enable=${{ github.event_name != 'pull_request' }}
  type=ref,event=pr

Event	Before	After
Pull request commit	<40-char sha>, unique and permanent	pr-123, moves to the newest image
Push to master	<40-char sha>	unchanged
Push of a v* tag	v4.5.0 + <40-char sha>	unchanged

When pr-123 moves, the index it pointed at keeps no tag and its platform children stop being reachable. That is exactly what the scheduled prune already deletes, so this routes the growth into cleanup that is already merged and has been observed running clean, instead of adding a rule that deletes tagged versions.

The guard is written as github.event_name != 'pull_request' rather than {{is_default_branch}} on purpose: the latter is false on a tag push, which would strip the commit-sha tag off release images.

What this gives up

A pull request image is addressable while the branch is the one being worked on, rather than forever. pr-123 gives you that branch's current image, not the one from three commits ago.

Measured against the last 56 closed pull requests in this repository: half close within about ten hours, 93% within seven days, and all within thirteen days. An image for an open pull request keeps being refreshed by each push, so it stays available for as long as the work is live.

Verification

make lint-workflows passes. The behavior this changes only appears once a build runs for a pull request, which this pull request is, so its own dockerhub-image job is the first exercise of it: it should publish pr-<this number> and no commit-sha tag.

Nothing else in the workflow depends on the pull request case. The "Verify the ghcr package is publicly pullable" step reads steps.meta.outputs.version, which becomes pr-<number> on a pull request, but that step is already guarded with if: github.event_name != 'pull_request'. DOCKER_METADATA_PR_HEAD_SHA stays, since it still selects the head sha for the org.opencontainers.image.revision label.

Not in this change

Finished pull requests still leave one image each, which wants a second cleanup step (delete-tags: 'pr-*' with its own older-than). That has to be a separate invocation of the action, because older-than restricts every rule in a single step and orphan cleanup wants a much shorter interval than finished pull requests do. It is worth landing only after this change has been seen working, since it has nothing to act on until pr-* tags exist.