From 09cb2da8c2964dce10e44982b591060b53040e67 Mon Sep 17 00:00:00 2001
From: vlakoff <544424+vlakoff@users.noreply.github.com>
Date: Thu, 30 Apr 2026 09:51:27 +0200
Subject: [PATCH] Prefer whitelist approach for Docker image push condition

Replace the exclusion-based condition with an explicit list
of events that should push an image. Any future trigger
added to the workflow will default to not pushing, which
is the safe behavior.
---
 .github/workflows/docker.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 29f83315..e310e91e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -36,7 +36,7 @@ jobs:
       context: . # Use local checkout to support GitHub Merge Queue
       output: image
       platforms: linux/amd64,linux/arm64
-      push: ${{ github.event_name != 'pull_request' && github.event_name != 'merge_group' }}
+      push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
       cache: ${{ github.event_name != 'workflow_dispatch' || inputs.use_cache }}
       # We don't sign the image because ghcr.io doesn't support OCI Referrers API yet, and the fallback relies on pushing new tags on each build
       # https://github.com/docker/github-builder/issues/109#issuecomment-3885082486