The unconditional type=raw,value=latest applied the latest tag to every
pushed git tag, including prereleases like v1.0.0-rc1. Removing it lets
metadata-action's default latest=auto flavor handle it, which only tags
latest for non-prerelease semver versions.
Fixes#2161
The auto-label workflow's LLM call succeeds, but the docker action ran
as a non-root user (`USER appuser` in the Dockerfile) and could not
write the runner's `GITHUB_OUTPUT` file:
```
Error: failed to set output: ... open /github/file_commands/set_output_...: permission denied
```
GitHub docker actions must run as root — the runner's file-command files
are owned by the runner user. Fixed in the fork
(tink-bot/LLM-action@8526bab removes the non-root user) and bumped the
pin here.
Failing run:
https://github.com/go-vikunja/vikunja/actions/runs/30904804523/job/91977288580
Co-authored-by: kolaente <k@knt.li>
Upstream rejects max_tokens/temperature for gpt-5 series models,
breaking auto-label with gpt-5.6-luna. Pin to the fork carrying
appleboy/LLM-action#24 until it is merged and released.
On pull_request_target, github.sha points to the base branch head, so
gh-describe baked main's version string into the preview image while the
code itself was the PR head. Pass the PR head sha explicitly.
Under pull_request_target, github.sha resolves to the base branch tip,
so every PR on the same main tip pushed the same sha-<base> tag and
preview images overwrote each other. DOCKER_METADATA_PR_HEAD_SHA makes
metadata-action use the PR head sha; the deploy comment derives its sha
from the meta output, so its per-commit URLs now match the pushed tag.
Fixes#3407
The job pushes with the SSH deploy key configured by actions/checkout's
ssh-key input, so GITHUB_TOKEN is never used for writes. Scope it down to
contents: read.
The workflow was missing the pull-requests write permission, so its PR
settings never had any effect. Grant it and close PRs two weeks after
the author goes silent, matching the contribution policy.
kolaente
renovate[bot]andkolaente
