From 0f20ffae9387f0e516b92cbf58352b48efa0ba6a Mon Sep 17 00:00:00 2001
From: Brandon Haney <121782102+Brandon-Haney@users.noreply.github.com>
Date: Wed, 29 Jul 2026 22:54:43 -0500
Subject: [PATCH] CI: publish Docker v2 manifests and cancel superseded builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two fixes to the image publishing workflow, both surfaced while bringing the
rolling :dev channel online in #200.

Docker v2 manifests. Images are pushed with OCI media types, and Unraid's
update check requests only Docker media types, so the registry returns 404 for
the manifest and the container reports "not available" rather than an update
status. Verified against the registry with Docker-only Accept headers:

  studionirin/plexcache-d:dev     -> 404  (application/vnd.oci.image.manifest.v1+json)
  studionirin/plexcache-d:latest  -> 200  (application/vnd.docker.distribution.manifest.v2+json)

`provenance: false` was already set and isn't sufficient on its own, so this
also disables SBOM attestation and sets oci-mediatypes=false via the image
exporter, which puts buildx back on a plain Docker v2 manifest. Pulling was
never affected — Docker handles OCI fine — so this only changes what the update
check can read. This matters most on a release: users whose update status reads
"not available" are never told a new version exists.

Cancel superseded builds. #199 and #200 merged 13 seconds apart. Both started a
build, and the older commit's run finished two seconds later, so it won the
:dev tag and left it pointing at a commit missing the newer merge. A
concurrency group keyed on the ref cancels the stale run so :dev always tracks
the newest push. Release builds use their own ref and are unaffected.

No change to which events publish or to the tags produced.
---
 .github/workflows/docker.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d330ca0..c0d6211 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -8,6 +8,14 @@ on:
   release:
     types: [published]
 
+# Two merges landing seconds apart each start a build, and whichever finishes
+# last wins the :dev tag — which can leave it pointing at the older commit.
+# Superseding runs on the same ref cancels the stale one so :dev always tracks
+# the newest push. Releases are keyed by their own ref and aren't affected.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -104,8 +112,13 @@ jobs:
         with:
           context: .
           file: docker/Dockerfile
-          push: true
           provenance: false
+          sbom: false
+          # Publish Docker v2 manifests rather than OCI. Unraid's update check
+          # requests only Docker media types, so an OCI-only manifest returns 404
+          # and the container reports "not available" instead of an update status.
+          # provenance: false alone isn't enough — buildx still emits OCI types.
+          outputs: type=image,oci-mediatypes=false,push=true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |