From aff58fbbeacc276320371c7470cc7e15ef98defe Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Mon, 27 Apr 2026 18:57:04 +0100
Subject: [PATCH] Add latest

---
 .github/workflows/semver-container.yml |  6 ++++++
 docs/workflows/semver-container.md     | 19 +++++++++++++++++--
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/semver-container.yml b/.github/workflows/semver-container.yml
index 7a81c6b..726cb55 100644
--- a/.github/workflows/semver-container.yml
+++ b/.github/workflows/semver-container.yml
@@ -16,6 +16,11 @@ on:
         description: 'The release tag to derive semver from (e.g. 1.2.3 or v1.2.3)'
         required: true
         type: string
+      tag-latest:
+        description: 'Also push a latest tag (only applied to stable releases, not pre-releases)'
+        required: false
+        default: false
+        type: boolean
 
 env:
   image-name: ${{ inputs.image-name }}
@@ -91,6 +96,7 @@ jobs:
             type=raw,value=${{ steps.version.outputs.version }}
             type=raw,value=${{ steps.version.outputs.major }},enable=${{ steps.version.outputs.is-prerelease == 'false' }}
             type=raw,value=${{ steps.version.outputs.major-minor }},enable=${{ steps.version.outputs.is-prerelease == 'false' }}
+            type=raw,value=latest,enable=${{ inputs.tag-latest && steps.version.outputs.is-prerelease == 'false' }}
 
       # Rather than rebuilding the image, we retag the existing edge image (tagged with
       # the commit SHA by publish-container) with the semver tags computed above.
diff --git a/docs/workflows/semver-container.md b/docs/workflows/semver-container.md
index 8587921..bf64f06 100644
--- a/docs/workflows/semver-container.md
+++ b/docs/workflows/semver-container.md
@@ -2,12 +2,12 @@
 
 Reusable workflow that:
 
-- tags an existing container image with semver tags (`x.y.z`, `x`, `x.y`) based on a provided release tag
+- tags an existing container image with semver tags (`x.y.z`, `x`, `x.y`) based on a provided release tag, and optionally `latest`
 - verifies that a corresponding container image (tagged with the commit SHA) already exists
 
 Use this when you already have an "edge" or commit-SHA container image (for example from the `publish-container` workflow) and you want to promote it to a semver release.
 
-> **Note:** The `x` and `x.y` floating tags are only applied for stable releases. Pre-release versions (e.g. `1.0.0-beta.1`) receive only the full version tag.
+> **Note:** The `x`, `x.y`, and `latest` floating tags are only applied for stable releases. Pre-release versions (e.g. `1.0.0-beta.1`) receive only the full version tag.
 
 ## Inputs
 
@@ -16,6 +16,7 @@ Use this when you already have an "edge" or commit-SHA container image (for exam
 | `image-name` | Yes      | —           | Image name, e.g. `my-app` or `services/api`.         |
 | `registry`   | No       | `'ghcr.io'` | Registry host.                                       |
 | `tag`        | Yes      | —           | The release tag to derive semver from (e.g. `1.2.3` or `v1.2.3`). Typically passed from the `release-tag` output of the `semantic-release` workflow. |
+| `tag-latest` | No       | `false`     | Also push a `latest` tag. Only applied to stable releases, not pre-releases. |
 
 ## Secrets
 
@@ -45,3 +46,17 @@ This will:
 
 - check that an image `ghcr.io/<owner>/my-service:<sha>` exists
 - push additional tags like `1.2.3`, `1`, and `1.2` to that image (or just `1.2.3` for pre-releases)
+
+To also push a `latest` tag on stable releases, set `tag-latest: true`:
+
+```yaml
+  semver-container:
+    needs: release
+    if: needs.release.outputs.release-created == 'true'
+    uses: health-informatics-uon/workflows/.github/workflows/semver-container.yml@main
+    with:
+      image-name: my-service
+      tag: ${{ needs.release.outputs.release-tag }}
+      tag-latest: true
+    secrets: inherit
+```