ci: only publish the Docker image from master

[widgetii]

main.yml triggered on push to every branch:

on:
  push:
    branches:
      - "*"

Since it builds and pushes braunbearded/python-dvr:latest unconditionally, any push to any branch rebuilt and overwrote :latest on Docker Hub with that branch's code — a footgun.

This scopes the trigger to master, so :latest tracks master only. workflow_dispatch is kept for manual runs, and the per-commit :${{ github.sha }} tag is unchanged.

No functional change to the image itself.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restrict automatic Docker image publishing to master

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Publishes Docker images automatically only for pushes to master.
• Prevents feature branches from overwriting Docker Hub’s latest tag.
• Retains manual dispatch and commit-specific image tags.

High-Level Assessment

The branch-scoped push trigger is the simplest and most appropriate fix. Adding conditional publish logic at the job or step level would preserve unnecessary workflow executions and increase configuration complexity.

Files changed (1) +1 / -1

Bug fix (1) +1 / -1

main.ymlLimit automatic Docker publishing to master +1/-1

Limit automatic Docker publishing to master

• Changes the push trigger from every branch to 'master', preventing branch builds from automatically replacing the 'latest' Docker image. Manual workflow dispatch and SHA-specific tagging remain unchanged.

.github/workflows/main.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Manual runs can overwrite the master image ✓ Resolved 🐞 Bug ≡ Correctness

Description

The workflow_dispatch trigger remains unrestricted while the Docker step always pushes the selected
revision to the latest tag. A maintainer who manually runs the workflow from a feature branch can
therefore overwrite the Docker Hub image with non-master code despite the new push filter.

Code

.github/workflows/main.yml[5]

+      - master

Evidence

The added branch filter applies only to push events; workflow_dispatch remains a separate
unrestricted trigger. The Docker build-and-push action unconditionally sets push: true and
publishes latest, so a manually selected non-master ref can still replace the image.

.github/workflows/main.yml[2-6]
.github/workflows/main.yml[16-24]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Manual workflow dispatches can be started from a feature branch, and the unconditional Docker push then overwrites the `latest` tag with that branch's code.
## Fix Focus Areas
- .github/workflows/main.yml[2-24]
## Recommended Fix
Keep `workflow_dispatch` if needed, but add a job or step condition that permits Docker publishing only when `github.ref` is `refs/heads/master` (or otherwise make manual runs from non-master refs build without pushing). Ensure both `latest` and commit-specific tags follow the intended publishing policy.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can choose which labels appear on a finding, and whether they show icons or text

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗