Linus Rath 582960ae06 ci: publish latest only from stable releases and scope workflow tokens ...

A manual run of the release image workflow tagged `latest` on whatever
ref it was dispatched from, and the demo deploy and every Watchtower
install follow `latest`. It now moves only for a published stable
release or a dispatch on a stable `v*` tag.

- `static-lite.yml` gave the whole workflow `contents: write`, including
  the build job that runs pull-request code. The build is read-only
  now; a separate release job with no checkout uploads the zips.
- `docker-publish.yml` passes the ref name through `env` instead of
  interpolating it into the shell script.

2026-09-26 16:30:23 +02:00

..

workflows

ci: publish latest only from stable releases and scope workflow tokens

2026-09-26 16:30:23 +02:00

FUNDING.yml

Add funding configuration for Bulwark Webmail

2026-04-02 00:37:58 +02:00