only move latest on a full release

[tomeichlersmith]

Describe the bug
When creating a pre-release (a tag with the -rcN suffix, a "pre-release" release on GitHub), the tags for the image were ldmx/dev:5.0.0-rc0 and ldmx/dev:latest. I want it to be only ldmx/dev:5.0.0-rc0.

[tomeichlersmith]

Welp, false alarm.

The only reason it included latest in the tags during the build step is because I don't provide that action any parameters.

dev-build-context/.github/workflows/ci.yml

Lines 38 to 43 in 89997a0

	-
	name: Docker meta
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ env.REGISTRY_IMAGE }}

But I don't provide these tags when pushing, I just use this action to get labels.

dev-build-context/.github/workflows/ci.yml

Lines 56 to 66 in 89997a0

	-
	name: Build and push by digest
	id: build
	uses: docker/build-push-action@v6
	with:
	context: .
	cache-from: type=registry,ref=ldmx/dev:build-cache-${{ matrix.platform }}
	cache-to: type=registry,ref=ldmx/dev:build-cache-${{ matrix.platform }},mode=max
	platforms: linux/${{ matrix.platform }}
	labels: ${{ steps.meta.outputs.labels }}
	outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true

The final merge step which does push the tags uses appropriate parameters to prevent latest from being attached.

dev-build-context/.github/workflows/ci.yml

Lines 101 to 123 in 89997a0

	-
	name: Docker meta
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ env.REGISTRY_IMAGE }}
	tags: |
	type=ref,event=branch
	type=ref,event=pr
	type=semver,pattern={{version}}
	type=semver,pattern={{major}}.{{minor}}
	-
	name: Login to Docker Hub
	uses: docker/login-action@v3
	with:
	username: ${{ secrets.DOCKER_USERNAME }}
	password: ${{ secrets.DOCKER_PASSWORD }}
	-
	name: Create manifest list and push
	working-directory: digests
	run: |
	docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
	$(find -type f -exec basename {} ';' | xargs printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ')

I replicated this in tomeichlersmith/ldmx-multi-arch-test.

https://github.com/tomeichlersmith/ldmx-multi-arch-test/actions/runs/13859053387

[tomeichlersmith]

I added the tag deduction to the build step to avoid future Tom from doing the same mistake. 44862bd