From cb12adcccf906bed8659c3c4a85391bed3d91994 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Sat, 8 Aug 2026 01:06:24 +0200 Subject: [PATCH] docs(security): correct the image publish trigger The supply-chain section said the publish workflow runs on every push to main. That trigger was removed in v1.4.34, when the squash-merge and the release tag each kicked off their own build of the same SHA; the workflow has fired on v* tags only since. Pull requests still build the image, and do not publish it. --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 787a2c731..5210c4ba8 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -64,7 +64,7 @@ For more details, see the [security documentation](https://docs.healthlog.dev/se HealthLog Docker images are built and published from this repository's CI: -- **Source**: [`.github/workflows/docker-publish.yml`](.github/workflows/docker-publish.yml) — runs on every push to `main` and every `v*` tag +- **Source**: [`.github/workflows/docker-publish.yml`](.github/workflows/docker-publish.yml) — publishes on every `v*` tag; pull requests build the image without publishing it - **Registry**: [`ghcr.io/mbombeck/healthlog`](https://github.com/MBombeck/HealthLog/pkgs/container/healthlog) - **Architectures**: `linux/amd64` and `linux/arm64` - **Provenance attestation**: each image carries a [SLSA build provenance](https://slsa.dev/spec/v1.0/provenance) statement linking it back to the GitHub Actions run, the commit SHA, and the workflow definition