[Copilot]

Summary

• Run Docker image builds on pull_request events, skipping Docker Hub login and image pushes.
• Restrict branch-push builds to latest so Dependabot branch pushes cannot enter the credential-dependent publishing path. Preserve version-tag and scheduled publishing.
• Document which events build only and which publish.

Root cause

The failing Dependabot run was triggered by a branch push, not a pull_request. The workflow previously built every pushed branch and logged in unconditionally, so its existing PR-only push guard did not protect Dependabot runs without Docker Hub secrets.

Validation

• actionlint passed.
• Verified nine event scenarios: Dependabot, human, and fork PRs build without login/push; Dependabot and feature-branch pushes do not trigger; latest pushes, version tags, and scheduled runs still build and publish; non-version tags do not trigger.
• git diff --check passed.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b65772e2-1caa-4f86-bf1a-96dde15743bb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}