Build latest on every master push, add untagged version cleanup

Author: djkurlander

.github/workflows/docker-publish.yml

@@ -2,6 +2,8 @@ name: Build and Publish Docker Image
 
 on:
   push:
+    branches:
+      - master
     tags:
       - 'v*'
   workflow_dispatch:
@@ -45,10 +47,11 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            # For tag pushes: v1.0.0 → 1.0.0 + latest
+            # master push or version tag → latest
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') }}
+            # v1.2.3 tag push → 1.2.3 (also gets latest from above via ref)
             type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ github.event_name == 'push' }}
-            # For manual dispatch: use the input tag
+            # manual dispatch → use the input tag
             type=raw,value=${{ inputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' }}
 
       - name: Build and push
@@ -61,3 +64,18 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+  cleanup:
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    permissions:
+      packages: write
+
+    steps:
+      - name: Delete old untagged package versions
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: knock-knock
+          package-type: container
+          delete-only-untagged-versions: true
+          min-versions-to-keep: 5