From f2dd61c16efea587958166c46df24edc0aaf7fce Mon Sep 17 00:00:00 2001
From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com>
Date: Thu, 24 Sep 2026 15:57:35 +0300
Subject: [PATCH 1/2] ci: only publish the Docker image from master

main.yml triggered on push to every branch (branches: "*"), so any
branch push rebuilt and overwrote braunbearded/python-dvr:latest on
Docker Hub. Scope the trigger to master so :latest tracks master only;
workflow_dispatch stays for manual runs.
---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7196554..f2b1323 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,7 +2,7 @@ name: ci
 on:
   push:
     branches:
-      - "*"
+      - master
   workflow_dispatch:
 jobs:
   docker:

From c7d61b12744a7bd3cea183291012be0e9d863b99 Mon Sep 17 00:00:00 2001
From: Dmitry Ilyin <6576495+widgetii@users.noreply.github.com>
Date: Thu, 24 Sep 2026 16:04:54 +0300
Subject: [PATCH 2/2] ci: gate the Docker publish job on the master ref

Address review: the push branch filter alone did not cover
workflow_dispatch, so a manual run selecting a feature branch would
still publish and overwrite :latest. Gate the docker job on
github.ref == refs/heads/master so only master publishes, regardless of
how the workflow is triggered.
---
 .github/workflows/main.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f2b1323..219295a 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   docker:
     runs-on: ubuntu-latest
+    # Publish only from master, even for manual workflow_dispatch runs, so a
+    # dispatch from a feature branch can't overwrite the :latest image.
+    if: github.ref == 'refs/heads/master'
     steps:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1