fix(ci): point latest at the newest release, publish dev builds as edge

.github/workflows/release-please.yml

@@ -194,8 +194,13 @@ jobs:
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          # `latest` belongs to the newest RELEASE. It used to be applied by the
+          # dev path instead, so `docker pull ghcr.io/pelotech/xapi-lrs` returned
+          # an unreleased build off main — the opposite of what the convention
+          # promises. Dev builds are published as `edge` now.
           tags: |
             type=raw,value=${{ needs.release-please.outputs.tag_name }}
+            type=raw,value=latest
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ${{ env.REGISTRY }}
@@ -300,7 +305,7 @@ jobs:
 
   # ----------------------------------------------------------------------------
   # Dev path: builds per-arch on every non-release main push, merges into a
-  # `latest` manifest list.
+  # `edge` manifest list.
   # ----------------------------------------------------------------------------
   build-dev:
     if: ${{ needs.release-please.outputs.app_release_created != 'true' }}
@@ -386,7 +391,7 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=edge,enable={{is_default_branch}}
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ${{ env.REGISTRY }}
@@ -399,13 +404,13 @@ jobs:
             $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
       - name: Inspect image
         run: |
-          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:edge
       - name: Capture manifest digest
         id: digest
         run: |
           set -euo pipefail
           DIGEST=$(docker buildx imagetools inspect \
-            "${REGISTRY}/${IMAGE_NAME}:latest" \
+            "${REGISTRY}/${IMAGE_NAME}:edge" \
             --format '{{json .Manifest}}' | jq -r .digest)
           echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
         env:

README.md

@@ -205,6 +205,14 @@ Published images build on [Minimus](https://www.minimus.io/) hardened Node (`reg
 
 Two smaller consequences of FIPS mode, neither of which this application triggers today: MD5 throws wherever it is used, so a future dependency that hashes with MD5 will fail at runtime rather than silently degrade; and TLS is restricted to the NIST curves, which can affect outbound connections to endpoints offering only x25519.
 
+Published image tags:
+
+| Tag         | Points at                                           |
+| ----------- | --------------------------------------------------- |
+| `latest`    | the most recent release                             |
+| `<version>` | that exact release, e.g. `0.9.5` (immutable)        |
+| `edge`      | the current tip of `main` — unreleased, moves often |
+
 Container images published to `ghcr.io/pelotech/xapi-lrs` are signed with [Sigstore cosign](https://docs.sigstore.dev/) (keyless / OIDC) and carry SLSA build provenance attestations. Release images additionally have SPDX and CycloneDX SBOMs attached as Sigstore attestations and as downloadable release artifacts.
 
 Verify an image (substitute the tag):