From 6591a2f871ab303f40f538cffc48e4130df4cfde Mon Sep 17 00:00:00 2001
From: Reese Norris <reese.norris@gmail.com>
Date: Tue, 28 Jul 2026 16:43:42 -0400
Subject: [PATCH] ci: stop tagging dev branch images as :latest

Only main publishes :latest. Dev pushes get :dev (plus sha/branch tags)
so operators pulling :latest are not surprised by unstable tip builds.
---
 .github/workflows/ci.yml | 4 +---
 README.md                | 2 +-
 wiki/Deployment.md       | 2 +-
 wiki/Home.md             | 2 +-
 4 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fbe13c5..735ccb7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,11 +73,9 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            # Always publish branch tip tags; main also updates :latest.
+            # :latest is stable (main only). Dev pushes get :dev only — not :latest.
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
             type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
-            # While primary work is on dev, keep :latest in sync with dev too.
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/dev' }}
             type=sha,prefix=sha-
             type=ref,event=branch
             type=ref,event=pr
diff --git a/README.md b/README.md
index a87e4e2..e06e35f 100644
--- a/README.md
+++ b/README.md
@@ -99,7 +99,7 @@ Colocated mode (default) uses the shared DB and in-process service HTTP. For `-w
 
 Preferred for operators. See the [Deployment Wiki](https://github.com/renorris/openfsd/wiki/Deployment) (source: [`wiki/`](wiki/)).
 
-Images: **`ghcr.io/renorris/openfsd`** (`:latest`, `:dev`, `sha-*`) published by CI on every push to `main` and `dev`.
+Images: **`ghcr.io/renorris/openfsd`** — CI publishes `:latest` from **`main` only**, `:dev` from **`dev`** (unstable), plus `sha-*` / branch tags.
 
 **Upgrading from PostgreSQL?** Use [`openfsd-migrate-to-sqlite`](cmd/openfsd-migrate-to-sqlite) and [Migrating from PostgreSQL](wiki/Migrating-from-PostgreSQL.md). Optional multi-node: rqlite + mesh (`CLUSTER_ENABLED`, see [wiki/Deployment](wiki/Deployment.md) and `docs/design/distributed-openfsd.md`).
 
diff --git a/wiki/Deployment.md b/wiki/Deployment.md
index 7eedf1f..e42d3e1 100644
--- a/wiki/Deployment.md
+++ b/wiki/Deployment.md
@@ -27,7 +27,7 @@ docker compose up -d
 3. **Configure Server** — see [Configuration](Configuration.md)
 4. Connect a client — [Client Connection](Client-Connection.md)
 
-Images: **`ghcr.io/renorris/openfsd`** (`:latest`, `:dev`, `sha-*`) published by CI on pushes to `main` and `dev`.
+Images: **`ghcr.io/renorris/openfsd`** — CI publishes `:latest` from **`main` only**, `:dev` from **`dev`** (unstable), plus `sha-*` / branch tags.
 
 ### Service selection
 
diff --git a/wiki/Home.md b/wiki/Home.md
index 3f8f1ed..c490800 100644
--- a/wiki/Home.md
+++ b/wiki/Home.md
@@ -23,5 +23,5 @@ Operator documentation for [openfsd](https://github.com/renorris/openfsd).
 
 ## Quick links
 
-- Images: `ghcr.io/renorris/openfsd` (`:latest`, `:dev`, `sha-*`)
+- Images: `ghcr.io/renorris/openfsd` (`:latest` = main, `:dev` = unstable tip, `sha-*`)
 - Protocol notes: repository `docs/`