deploy_docker_dev.yml

name: Publish latest to DockerHub

# Manual only: this publishes i7gamer/myspeed:latest to Docker Hub, which should
# be a deliberate act rather than a side effect of every push.
#
# It builds through build-docker.yml, the same path the release chain takes, so
# :latest stays a multi-arch manifest covering amd64 and arm64. It used to build
# amd64 only, which replaced the manifest the release had published and left
# arm64 hosts on an image they could only run under emulation.
#
# Note that this still republishes :latest from the dispatched branch, so it
# overwrites released content with whatever is on that branch.
on:
  workflow_dispatch:

# The same group the release chain takes: both ends move :latest, and a deploy
# running beside a release decides what :latest means by whichever finishes
# last. Queued rather than cancelled - a half-published manifest is worse than
# a wait.
concurrency:
  group: release-and-registry
  cancel-in-progress: false

jobs:
  # The same two steps the release chain takes, for the same reason: the builds
  # push each architecture by digest, and the tag is a second, separate act.
  # Nothing gates them apart here - there are no binaries to wait for - but
  # keeping both callers on one path is what stops :latest ever being published
  # by something that did not build both architectures.
  build:
    name: "Build"
    # Only the checkout inside build-docker.yml needs the token; the push
    # authenticates against Docker Hub separately.
    permissions:
      contents: read
    uses: ./.github/workflows/build-docker.yml
    with:
      ref: ${{ github.ref }}
    secrets: inherit

  publish:
    name: "Publish"
    needs: build
    permissions:
      contents: read
    uses: ./.github/workflows/publish-docker.yml
    with:
      tags: latest
    secrets: inherit