fix: stop the raw dispatch tag from moving :latest on every run

.github/workflows/build.yml

@@ -85,7 +85,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Build and Push by digest
-        uses: specsnl/github-actions/build-image@2.4.2
+        uses: specsnl/github-actions/build-image@2.4.3
         with:
           dockerfile: ${{ inputs.dockerfile }}
           context: ${{ inputs.context }}

.github/workflows/merge.yml

@@ -67,7 +67,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Create Manifest
-        uses: specsnl/github-actions/create-manifest@2.4.2
+        uses: specsnl/github-actions/create-manifest@2.4.3
         with:
           image-name: ${{ steps.image_name.outputs.lowercase }}
           target: ${{ inputs.target }}

README.md

@@ -3,7 +3,7 @@
 This repository contains the Specsnl organisation collection of GitHub Actions workflows and composite actions that can
 be reused to automate various tasks in GitHub repositories.
 
-Consumers pin by tag, i.e. `specsnl/github-actions/.github/workflows/build.yml@2.4.2`.
+Consumers pin by tag, i.e. `specsnl/github-actions/.github/workflows/build.yml@2.4.3`.
 
 ## What is in here
 

build-image/action.yml

@@ -108,7 +108,7 @@ runs:
       with:
         images: ${{ inputs.image-name }}
         tags: |
-          type=raw,event=workflow_dispatch,value=${{ steps.raw_tag.outputs.lowercase }}
+          type=raw,value=${{ steps.raw_tag.outputs.lowercase }},enable=${{ github.event_name == 'workflow_dispatch' }}
         labels: |
           ${{ inputs.title != '' && format('org.opencontainers.image.title={0}', inputs.title) || '' }}
           ${{ inputs.description != '' && format('org.opencontainers.image.description={0}', inputs.description) || '' }}

create-manifest/action.yml

@@ -69,7 +69,7 @@ runs:
           type=ref,event=branch
           type=ref,event=tag
           type=ref,event=pr
-          type=raw,event=workflow_dispatch,value=${{ steps.raw_tag.outputs.lowercase }}
+          type=raw,value=${{ steps.raw_tag.outputs.lowercase }},enable=${{ github.event_name == 'workflow_dispatch' }}
           ${{ inputs.raw-tags }}
         flavor: ${{ inputs.flavor }}
         labels: |

docs/actions.md

@@ -9,7 +9,7 @@ Both assume the job has already checked out, logged in to the registry and set u
 ## `build-image`
 
 ```yaml
-- uses: specsnl/github-actions/build-image@2.4.2
+- uses: specsnl/github-actions/build-image@2.4.3
 ```
 
 | Input         | Default    | Description                                                                            |
@@ -42,7 +42,7 @@ about conflicting outputs. With `load` on, the digest export and artifact upload
 ## `create-manifest`
 
 ```yaml
-- uses: specsnl/github-actions/create-manifest@2.4.2
+- uses: specsnl/github-actions/create-manifest@2.4.3
 ```
 
 | Input         | Default    | Description                                                                                |

docs/go-cli.md

@@ -21,7 +21,7 @@ permissions:
 jobs:
 
   build:
-    uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.2
+    uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.3
     strategy:
       fail-fast: false
       matrix:
@@ -39,7 +39,7 @@ jobs:
 
   merge:
     needs: build
-    uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.2
+    uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.3
     with:
       runs-on: ubuntu-24.04
       image-name: ghcr.io/specsnl/specs-cli
@@ -123,7 +123,7 @@ Run the build and merge jobs once per variant, each with its own `target`:
 
 ```yaml
   build-alpine:
-    uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.2
+    uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.3
     strategy:
       fail-fast: false
       matrix:
@@ -141,7 +141,7 @@ Run the build and merge jobs once per variant, each with its own `target`:
 
   merge-alpine:
     needs: build-alpine
-    uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.2
+    uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.3
     with:
       runs-on: ubuntu-24.04
       image-name: ghcr.io/specsnl/specs-cli

docs/php.md

@@ -8,7 +8,7 @@ what name.
 jobs:
 
   build:
-    uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.2
+    uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.3
     strategy:
       fail-fast: false
       matrix:
@@ -24,7 +24,7 @@ jobs:
 
   merge:
     needs: build
-    uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.2
+    uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.3
     with:
       runs-on: ubuntu-24.04
       image-name: ghcr.io/${{ github.repository }}

docs/pipeline.md

@@ -32,13 +32,25 @@ Artifacts are kept for one day. They are an implementation detail of a single ru
 
 Tagging happens entirely in phase 2, from `metadata-action`. `create-manifest` always emits:
 
-| Directive                          | Produces                                             |
-|------------------------------------|------------------------------------------------------|
-| `type=schedule`                    | `nightly` on a scheduled run                         |
-| `type=ref,event=branch`            | The branch name, i.e. `main`                         |
-| `type=ref,event=tag`               | The tag name verbatim, i.e. `v1.2.3` or `2.2.0`      |
-| `type=ref,event=pr`                | `pr-<number>`                                        |
-| `type=raw,event=workflow_dispatch` | The `raw-tag` input, lowercased, `latest` by default |
+| Directive                 | Produces                                             |
+|---------------------------|------------------------------------------------------|
+| `type=schedule`           | `nightly` on a scheduled run                         |
+| `type=ref,event=branch`   | The branch name, i.e. `main`                         |
+| `type=ref,event=tag`      | The tag name verbatim, i.e. `v1.2.3` or `2.2.0`      |
+| `type=ref,event=pr`       | `pr-<number>`                                        |
+| `type=raw`, on dispatch   | The `raw-tag` input, lowercased, `latest` by default |
+
+That last one is filtered with `enable=${{ github.event_name == 'workflow_dispatch' }}`, not
+`event=workflow_dispatch`. `event=` belongs to `type=ref`; `type=raw` takes only `enable`, `priority`, `prefix`,
+`suffix` and `value`. An `event=` written on a `type=raw` directive does not fail — metadata-action ignores the
+attribute it does not know, and the tag silently becomes unconditional. That is worth remembering when editing
+either tags block: the mistake has no symptom until a tag lands somewhere it should not.
+
+`build-image` carries the same directive, where it has no effect on the registry — that build pushes by digest, so
+its computed tags are never applied. It is the only directive in that block, so what it does decide is
+`org.opencontainers.image.version` on the per-architecture images. Filtered to dispatch runs, tag and branch builds
+now leave that label unset and `metadata-action` logs `No Docker tag has been generated`. `build-image` takes no
+`version` input, so there is nothing truer to put there; the manifest gets its own version from `create-manifest`.
 
 Two inputs extend that:
 
@@ -52,6 +64,10 @@ Two inputs extend that:
 `flavor: latest=false` and add your own guarded `latest` tag through `raw-tags`, which is what
 [`merge-go-cli.yml`](go-cli.md) does.
 
+Note that `flavor: latest=false` only governs the implicit `:latest` that `type=ref` and `type=semver` bring with
+them. It has no effect on an explicit `type=raw,value=latest`, which is why the dispatch directive above needs a
+filter of its own rather than relying on the flavor.
+
 ## Labels and annotations
 
 `title`, `description` and `version` override the corresponding `org.opencontainers.image.*` values. Anything left

docs/testing-images.md

@@ -21,7 +21,7 @@ jobs:
       - uses: docker/setup-buildx-action@v4
 
       - id: build
-        uses: specsnl/github-actions/build-image@2.4.2
+        uses: specsnl/github-actions/build-image@2.4.3
         with:
           platform: linux/amd64
           image-name: ghcr.io/specsnl/specs-cli