From 83911b842f773ca98578899ed3819ea9c705d7f4 Mon Sep 17 00:00:00 2001
From: dresber <dresber@users.noreply.github.com>
Date: Sun, 14 Jun 2026 09:51:36 +0200
Subject: [PATCH] implement an edge tag and update image security check
 accordingly

---
 .gitea/workflows/docker-publish.yml        | 11 +++++++++++
 .gitea/workflows/image-security-checks.yml |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index c7c8c73..d8d71a5 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -9,6 +9,9 @@ on:
       dockerfile_path:
         type: string
         default: "."
+      floating_tag:
+        type: string
+        default: "edge"
       run_image_scan:
         type: boolean
         default: true
@@ -68,6 +71,11 @@ jobs:
             -t "${FULL_IMAGE}:${SHA_SHORT}" \
             ${{ inputs.dockerfile_path }}
 
+          # Floating tag points at the most recent build on any branch/tag, so
+          # the nightly image-security scan always has a stable target even
+          # before a release exists. ":latest" stays release-only (below).
+          docker tag "${FULL_IMAGE}:${SHA_SHORT}" "${FULL_IMAGE}:${{ inputs.floating_tag }}"
+
           if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
             VERSION="${{ gitea.ref_name }}"
             VERSION="${VERSION#v}"
@@ -143,6 +151,9 @@ jobs:
           echo "=== Push SHA tag ==="
           docker push "${FULL_IMAGE}:${SHA_SHORT}"
 
+          echo "=== Push floating tag (${{ inputs.floating_tag }}) ==="
+          docker push "${FULL_IMAGE}:${{ inputs.floating_tag }}"
+
           if echo "${{ gitea.ref }}" | grep -q '^refs/tags/v'; then
             echo "=== Version tag detected ==="
 
diff --git a/.gitea/workflows/image-security-checks.yml b/.gitea/workflows/image-security-checks.yml
index 947ca15..76a1ba3 100644
--- a/.gitea/workflows/image-security-checks.yml
+++ b/.gitea/workflows/image-security-checks.yml
@@ -8,7 +8,7 @@ on:
         type: string
       image_tag:
         type: string
-        default: "latest"
+        default: "edge"
       scan_severity:
         type: string
         default: "HIGH,CRITICAL"