The push job called build-push-action twice, once for the ref tag and once
for latest. Two builds meant the two tags could resolve to different manifest
digests. Build once and let docker/metadata-action supply both tags and the
OCI labels for that single build.
Replace the deprecated actions/checkout@v2 and docker/build-push-action@v1,
default workflow permissions to contents: read so pull requests cannot reach
publication credentials, and authenticate with a scoped DOCKER_TOKEN through
docker/login-action instead of DOCKER_PASSWORD.
The test job's docker-compose.test.yml branch was dead; that file does not
exist in the repository.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Maxim ShulgaandClaude Opus 5
9b9d4f0577