Publish an image for each push to main

.github/workflows/publish.yml

@@ -3,6 +3,14 @@ name: Publish Docker image
 on:
   workflow_dispatch:
   push:
+    # Each merge to main is published as main and sha-<short sha>, so a fix
+    # can be tried before the next release. Docs-only changes are skipped;
+    # path filters don't apply to tag pushes.
+    branches:
+      - main
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
     tags:
       - "v*"
   # A draft release made by monthly-release.yml is published by hand. Releases
@@ -49,6 +57,13 @@ jobs:
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302
         with:
           images: ghcr.io/${{ github.repository }}
+          # The action's default tags, plus sha-<short sha> for main.
+          tags: |
+            type=schedule
+            type=ref,event=branch
+            type=ref,event=tag
+            type=ref,event=pr
+            type=sha,enable={{is_default_branch}}
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 

README.md

@@ -1780,6 +1780,8 @@ Images for linux/amd64 and linux/arm64 are published to `ghcr.io/git-pkgs/proxy`
 docker run -p 8080:8080 -v proxy-data:/data ghcr.io/git-pkgs/proxy:latest
 ```
 
+Each merge to `main` is also published, tagged `main` and `sha-<short commit>`, to try a change before the next release. They are not releases: `latest` only moves with a release.
+
 To build the image from the repo instead:
 
 ```bash