From 72cf1d0a6135a7fc51aaf42a97b0ed16834e1ae7 Mon Sep 17 00:00:00 2001
From: Joe George <joe@zeroc.com>
Date: Tue, 15 Sep 2026 11:14:49 -0400
Subject: [PATCH 1/3] Align the image workflow with the shared shape

---
 .github/workflows/ci.yml | 51 ++++++++++++++++++++++++++++++----------
 1 file changed, 38 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 91bf575..a530ac2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,19 +1,28 @@
 name: ci
 
 on:
-  workflow_dispatch:
   push:
     branches: ["main"]
   pull_request:
     branches: ["main"]
   schedule:
-    - cron: "0 0 * * 0"
+    - cron: "0 0 * * 0" # weekly, so base-image fixes reach the deployed image
+
+# One active run per ref. On PRs, newer pushes cancel older in-progress runs;
+# on main, runs queue instead so an in-flight publish/deploy always finishes.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
-  build-push-deploy:
+  image:
+    name: Build image
     runs-on: ubuntu-latest
-    permissions:
-      packages: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -30,7 +39,7 @@ jobs:
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
-          username: ${{ github.repository_owner }}
+          username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up QEMU
@@ -42,17 +51,28 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          push: ${{ github.event_name != 'pull_request' }}
+          context: .
           platforms: linux/amd64,linux/arm64
+          pull: true
+          # Attestations show up as extra unknown/unknown entries in the manifest.
+          provenance: false
+          push: ${{ github.event_name != 'pull_request' && github.repository == 'icerpc/hello' }}
           tags: |
-            icerpc/hello:latest
-            ghcr.io/icerpc/hello:latest
+            icerpc/helloatest
+            ghcr.io/icerpc/hello:${{ github.sha }}
+            ghcr.io/icerpc/helloatest
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+  deploy:
+    name: Deploy
+    needs: image
+    if: github.event_name != 'pull_request' && github.repository == 'icerpc/hello'
+    runs-on: ubuntu-latest
+
+    steps:
       - name: Deploy
         uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
-        if: github.event_name != 'pull_request'
         with:
           host: ${{ secrets.HELLO_HOST }}
           username: ${{ secrets.HELLO_USERNAME }}
@@ -63,11 +83,16 @@ jobs:
             docker compose up -d hello-icerpc
             docker system prune -f
 
-      - name: Delete old container images
-        if: github.event_name != 'pull_request'
+  cleanup:
+    name: Cleanup old images
+    needs: image
+    if: github.event_name != 'pull_request' && github.repository == 'icerpc/hello'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete old container images (keep the 10 most recent)
         uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0
         with:
           package-name: hello
           package-type: container
           min-versions-to-keep: 10
-          delete-only-untagged-versions: true

From 369c9cdc988892e51bc4b5a9d5b8f9a3fa4d7a1d Mon Sep 17 00:00:00 2001
From: Joe George <joe@zeroc.com>
Date: Tue, 15 Sep 2026 11:19:03 -0400
Subject: [PATCH 2/3] Drop the cron comment

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a530ac2..3fa4eaa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: ["main"]
   schedule:
-    - cron: "0 0 * * 0" # weekly, so base-image fixes reach the deployed image
+    - cron: "0 0 * * 0"
 
 # One active run per ref. On PRs, newer pushes cancel older in-progress runs;
 # on main, runs queue instead so an in-flight publish/deploy always finishes.

From 902553fae64a8c191bb63a16145acd24add18f81 Mon Sep 17 00:00:00 2001
From: Joe George <joe@zeroc.com>
Date: Tue, 15 Sep 2026 11:20:26 -0400
Subject: [PATCH 3/3] Fix the latest tags

---
 .github/workflows/ci.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3fa4eaa..04a7cd2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,9 +58,9 @@ jobs:
           provenance: false
           push: ${{ github.event_name != 'pull_request' && github.repository == 'icerpc/hello' }}
           tags: |
-            icerpc/helloatest
+            icerpc/hello:latest
             ghcr.io/icerpc/hello:${{ github.sha }}
-            ghcr.io/icerpc/helloatest
+            ghcr.io/icerpc/hello:latest
           cache-from: type=gha
           cache-to: type=gha,mode=max