Fix proton-bridge publish tagging semantics

Author: mgarratt

.github/workflows/publish.yml

@@ -75,14 +75,29 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - id: latest-guard
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch --no-tags --depth=1 origin main
+          main_head="$(git rev-parse origin/main)"
+          if [[ "${GITHUB_SHA}" == "${main_head}" ]]; then
+            echo "publish_latest=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish_latest=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - id: meta
         shell: bash
         run: |
           set -euo pipefail
           base="ghcr.io/${{ github.repository }}/${{ matrix.image_name }}"
           short="${GITHUB_SHA::7}"
 
-          tags=("$base:latest" "$base:sha-$short")
+          tags=("$base:sha-$short")
+          if [[ "${{ steps.latest-guard.outputs.publish_latest }}" == "true" ]]; then
+            tags=("$base:latest" "${tags[@]}")
+          fi
           if [[ -n "${{ matrix.version }}" ]]; then
             tags+=("$base:${{ matrix.version }}")
           fi

images/proton-bridge/image.toml

@@ -1,4 +1,4 @@
 image = "proton-bridge"
-version = "3.21.2"
+version = "3.22.0"
 platforms = ["linux/amd64", "linux/arm64"]
 build_args = { ENV_PROTONMAIL_BRIDGE_VERSION = "v3.22.0", ENV_PROTONMAIL_BRIDGE_COMMIT = "87bba395d0f93301ac318d9b5cffde3312bbe13e" }