From 920605f6b472cc2abe44d38d040f65e1d3f5945c Mon Sep 17 00:00:00 2001
From: Anna Effort <anna.effort@ibm.com>
Date: Thu, 20 Aug 2026 09:58:06 -0700
Subject: [PATCH 1/2] fix: document the actual published image tag (X.Y.Z, not
 vX.Y.Z)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docker/metadata-action's `type=semver,pattern={{version}}` strips the
leading `v` from the git tag, so `v0.1.0` publishes as image tag `0.1.0`.
The release body built its pull command from `github.ref_name` (the raw
git tag), advertising `:v0.1.0` — a tag that is never pushed. DOCKER.md
had the same `:vX.Y.Z` mistake in both the pull command and the compose
override example.

Use `steps.meta.outputs.version` for the release body so it always
matches the primary tag actually pushed.

Signed-off-by: Anna Effort <anna.effort@ibm.com>
---
 .github/workflows/docker-release.yml |  2 +-
 DOCKER.md                            | 11 ++++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 98db9ba..9c77d99 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -143,7 +143,7 @@ jobs:
             ## Container image
 
             ```
-            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ github.ref_name }}
+            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ steps.meta.outputs.version }}
             ```
 
             Signed with [Cosign](https://docs.sigstore.dev/cosign/overview/) (keyless OIDC) — verify with:
diff --git a/DOCKER.md b/DOCKER.md
index 02b132d..452873d 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -20,14 +20,15 @@ point `CONTEXTFORGE_URL` at.
 
 ## Published image
 
-Tagged releases (`vX.Y.Z`, matching the repo's git tags) are built and
-pushed to GHCR by `.github/workflows/docker-release.yml`:
+Tagged releases are built and pushed to GHCR by
+`.github/workflows/docker-release.yml`. Note that the image tag drops the
+`v` the git tag carries — git `vX.Y.Z` publishes as image `X.Y.Z`:
 
 ```bash
-docker pull ghcr.io/contextforge-org/contextforge-web-ui:vX.Y.Z
+docker pull ghcr.io/contextforge-org/contextforge-web-ui:X.Y.Z
 ```
 
-Also available: the `vX.Y` (minor) tag, and `latest` (stable releases
+Also available: the `X.Y` (minor) tag, and `latest` (stable releases
 only — prerelease/RC tags don't move it). Built for `linux/amd64` and
 `linux/arm64`. See the repo's **Releases** and **Packages** tabs for the
 full list of published tags, signatures, and SBOMs.
@@ -39,7 +40,7 @@ locally, override the `app` service's `build:` key with `image:`:
 # docker-compose.override.yml
 services:
   app:
-    image: ghcr.io/contextforge-org/contextforge-web-ui:vX.Y.Z
+    image: ghcr.io/contextforge-org/contextforge-web-ui:X.Y.Z
 ```
 
 ```bash

From f4dae43a2d2f5ed111b6e68a0b8478c603ca8065 Mon Sep 17 00:00:00 2001
From: Anna Effort <anna.effort@ibm.com>
Date: Thu, 20 Aug 2026 10:00:33 -0700
Subject: [PATCH 2/2] fix: stop deriving the "latest" tag twice

metadata-action's default flavor is latest=auto, which already emits
"latest" for stable semver refs and omits it for prereleases. The
explicit type=raw,value=latest line duplicated that, so every stable
release derived "latest" twice (tag-names: 0.1.0, 0.1, latest, latest).

Pin latest=auto explicitly rather than relying on the implicit default,
and drop the redundant type=raw line. The prerelease guard it was
carrying is now handled by auto's semver parsing instead of a
string check for "-" in the ref name.

Signed-off-by: Anna Effort <anna.effort@ibm.com>
---
 .github/workflows/docker-release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 9c77d99..fa251af 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -77,12 +77,12 @@ jobs:
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
-          # Skip the "latest" tag for prerelease refs (e.g. v1.0.0-RC-3) so
-          # they never clobber the stable tag.
+          # latest=auto emits "latest" for stable semver and skips prereleases.
+          flavor: |
+            latest=auto
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
 
       - name: ✅  Validate derived tags
         run: |