[mattwoberts]

Follow-up to #1755, #1756 and #1757.

Docker Hub has 532 tags for getfider/fider. 93 of the latest 100 are PR_* or SHA_* images that nothing deploys. Hosted deploys main, and self-hosters use stable or vX.Y.Z.

publish.yml

• Only pushes to main and published releases publish images. Automatic PR_<n> images are gone.
• SHA_<sha> images are no longer published. main is the only branch tag.
• Job-level concurrency per event and ref. Publishes for main run one at a time, so an older build that finishes last can no longer move main, which hosted deploys, back to older code. Each release has its own group, so releases never wait on each other.
• permissions: contents: read. The repo default token is write, and this job builds code while holding the Docker Hub secrets. Docker: protect stable tag #1757's releases/latest call only needs read access.
• persist-credentials: false on checkout.

publish-pr-multiarch.yml (on-demand PR images, e.g. for test instances)

• Fixes checkout. It used to build the ref the workflow was dispatched from (usually main) and only used pr_number for the tag name. It now checks out refs/pull/<n>/head, so fork PRs work too.
• COMMITHASH is now the PR head commit.
• pr_number input is type: number.
• Reads the gha build cache but no longer writes it, so PR code can't seed layers that main and release builds reuse.
• permissions: contents: read, persist-credentials: false.

Not tested. workflow_run workflows always run from main's copy, so this PR's CI doesn't exercise them. After merge, check:

• the next push to main updates getfider/fider:main;
• running "Manually Publish PR with ARM64" for an open PR pushes PR_<n> with that PR's code.

After merge (manual): delete the old PR_* and SHA_* tags on Docker Hub if wanted.

🤖 Generated with Claude Code

[mattwoberts]

@kevinpapst Apologies for the claude-noise, but does the gist of this change make sense to you - I'm streamlining the process so we don't keep creating and pushing tags for all PRs

[kevinpapst]

Good cleanup. I wasn't sure if you need the tags, that's why I left them out in my PRs.
The permissions: read is wildly recommended for security.
And the removal of all the (likely) unused docker tags makes the hub page much more user friendly.

One tiny feedback, unrelated to the actual change.

LGTM 👍