fix(release): publish immutable image tags only

.gitea/workflows/release.yml

@@ -130,10 +130,8 @@ jobs:
             --target runner \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager:latest
 
       - name: Build and push Discord bot image
         if: steps.release.outputs.created == 'true'
@@ -145,10 +143,8 @@ jobs:
             --target bot \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager-bot:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager-bot:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager-bot:latest
 
       - name: Build and push migration image
         if: steps.release.outputs.created == 'true'
@@ -160,10 +156,8 @@ jobs:
             --target migrate \
             --build-arg VERSION="$VERSION" \
             -t "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}" \
-            -t git.garvis.dev/dmg/minecraft-account-manager-migrate:latest \
             .
           docker push "git.garvis.dev/dmg/minecraft-account-manager-migrate:${VERSION}"
-          docker push git.garvis.dev/dmg/minecraft-account-manager-migrate:latest
 
       - name: Create Gitea release and upload Velocity JAR
         if: steps.release.outputs.created == 'true'

design/log.md

@@ -2,6 +2,7 @@
 
 ## 2026-08-01
 
+* **Refine**: Removed mutable `latest` publication so all deployable artifacts use explicit semantic versions.
 * **Verify**: Confirmed the `v1.1.0` Discord bot image and matching web, migration, and Velocity artifacts.
 * **Extend**: Added a releasable Discord bot image and a dependency-free web health endpoint for Kubernetes deployment.
 * **Verify**: Confirmed the initial `v1.0.0` release, public Velocity JAR, and versioned and `latest` web and migration image manifests.

design/us-016-automated-releases.md

@@ -3,9 +3,9 @@ type: User Story
 title: Build and publish versioned releases
 description: Gitea Actions validate every change and publish semantically versioned Velocity and container artifacts.
 tags: [operations, ci, release, velocity, docker]
-timestamp: 2026-08-01T19:55:10Z
+timestamp: 2026-08-01T19:56:39Z
 story_id: US-016
-status: verified
+status: implemented
 ---
 
 # User Story
@@ -20,9 +20,10 @@ As a platform operator, I want automated validation and semantic releases, so th
 - [x] Main-branch conventional commits determine the next semantic version and create a `vMAJOR.MINOR.PATCH` tag.
 - [x] A release build embeds the semantic version in the Velocity plugin and JAR filename.
 - [x] A public Gitea release exposes the versioned Velocity JAR as a downloadable asset.
-- [x] Releases publish versioned and `latest` web runtime images to the Gitea registry.
+- [x] Releases publish semantically versioned web runtime images to the Gitea registry.
-- [x] Releases publish versioned and `latest` Discord bot images to the Gitea registry.
+- [x] Releases publish semantically versioned Discord bot images to the Gitea registry.
-- [x] Releases publish versioned and `latest` migration images that run versioned Drizzle migrations.
+- [x] Releases publish semantically versioned migration images that run versioned Drizzle migrations.
+- [ ] Releases do not publish mutable container tags such as `latest`.
 - [x] Runtime containers use unprivileged users and exclude development source and secrets where practical.
 - [x] Operators are told which repository secrets must be configured before the first push.
 
@@ -37,7 +38,7 @@ As a platform operator, I want automated validation and semantic releases, so th
 
 # Validation
 
-Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. Initial Gitea CI and release runs succeeded. Release `v1.0.0` provides a publicly downloadable JAR whose Velocity metadata reports `1.0.0`. Registry manifests were resolved for versioned and `latest` web and migration images. Release `v1.1.0` also publishes resolvable versioned web, Discord bot, and migration manifests and a public Velocity JAR whose metadata reports `1.1.0`. Pull-request commitlint configuration is present; its conditional execution will be exercised by the first pull request.
+Local OKF, lint, typecheck, test, Next.js build, and versioned Velocity JAR checks pass. Initial Gitea CI and release runs succeeded. Release `v1.0.0` provides a publicly downloadable JAR whose Velocity metadata reports `1.0.0`. Registry manifests were resolved for the published semantic-version tags. Release `v1.1.0` also publishes resolvable versioned web, Discord bot, and migration manifests and a public Velocity JAR whose metadata reports `1.1.0`. Pull-request commitlint configuration is present; its conditional execution will be exercised by the first pull request.
 
 # Related Stories
 

docs/releases.md

@@ -32,13 +32,10 @@ Each release creates:
 
 - Gitea release asset `minecraft-account-manager-velocity-VERSION.jar`
 - `git.garvis.dev/dmg/minecraft-account-manager:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager:latest`
 - `git.garvis.dev/dmg/minecraft-account-manager-bot:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager-bot:latest`
 - `git.garvis.dev/dmg/minecraft-account-manager-migrate:VERSION`
-- `git.garvis.dev/dmg/minecraft-account-manager-migrate:latest`
 
-Use immutable version tags for deployments. `latest` is a convenience pointer to the newest release.
+Only immutable semantic-version tags are published. Mutable tags such as `latest` must never be used in deployments or release-asset URLs.
 
 ## Discord bot