dunn.dev/pipeline 4.8.0 `container-image` stops publishing `:latest` from MR pipelines. A **minor**: no template input added, removed or renamed. A consumer that forces a build on every pipeline now gets `:<short-sha>` alone, unsigned, off the default branch and tags. ### Fixed - **`container-image`: `:latest` and its cosign signature are pushed only on the default branch or a tag pipeline.** Previously every firing — including a `BUILD_CI_IMAGE`-forced build on an MR pipeline — pushed and signed `:latest`, so a consumer that force-builds every pipeline (e.g. for a per-pipeline e2e image) republished and signed the public `:latest` from every MR, Renovate's included. Any other build now pushes `:<short-sha>` alone, unsigned. Single-arch and multi-arch manifest paths both changed; digest-file signing is unchanged.