Release v0.1.2

.github/workflows/build-and-push.yml

@@ -63,3 +63,9 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64
+          # Push a plain single-platform image manifest, NOT an OCI index with
+          # provenance/SBOM attestation child manifests. Those children are
+          # untagged and were being deleted by the weekly untagged-image cleanup,
+          # which left every tag pointing at a missing manifest (404 on pull).
+          provenance: false
+          sbom: false

.github/workflows/cleanup-images.yml

@@ -29,11 +29,17 @@ jobs:
     permissions:
       packages: write
     steps:
-      # actions/delete-package-versions has no native age gating; runs weekly
-      # for finer control a script querying the GHCR API by date would be needed
+      # WARNING: "untagged" versions include the per-platform image manifests and
+      # the provenance/SBOM attestation manifests that make up a tagged OCI *index*.
+      # Deleting those breaks the tagged image — pulls 404 on the missing child.
+      # build-and-push.yml now pushes plain single-platform manifests
+      # (provenance/sbom disabled), so normal builds create no untagged children and
+      # this job only reaps genuinely-orphaned old manifests. Keep a buffer so a
+      # freshly-overwritten tag's prior digest isn't reaped before it settles, and
+      # never set min-versions-to-keep to 0 while any indexed/attested image exists.
       - uses: actions/delete-package-versions@v5
         with:
           package-name: labelforge
           package-type: container
-          min-versions-to-keep: 0
+          min-versions-to-keep: 5
           delete-only-untagged-versions: true

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to labelforge are recorded here. Format follows [Keep a Chan
 
 ## [Unreleased]
 
+## [0.1.2] — 2026-06-07
+
+### Fixed
+
+- **Published container image was unpullable (`manifest unknown` / 404)** — the publish
+  workflow built with `docker/build-push-action` defaults, which attach provenance/SBOM
+  *attestations* and turn each pushed tag into an OCI image index whose per-platform and
+  attestation manifests are **untagged**. The weekly "Cleanup Container Images" job deleted
+  untagged versions with `min-versions-to-keep: 0`, removing those child manifests and leaving
+  every tag (`:latest`, `:v0.1.1`, …) pointing at a missing manifest. The build now pushes a
+  plain single-platform manifest (`provenance: false`, `sbom: false`), and the cleanup keeps a
+  buffer (`min-versions-to-keep: 5`) with a warning that untagged-deletion is unsafe for
+  indexed/attested images. Pulling `:latest` works again after the next publish.
+
 ## [0.1.1] — 2026-06-06
 
 ### Added

CLAUDE.md

@@ -10,7 +10,7 @@ Owner: crzykidd. Personal homelab project, public open source. Single-user app 
 
 ## Build Status
 
-- **Last shipped:** v0.1.1
+- **Last shipped:** v0.1.2
 - **Target for next release:** TBD
 
 ## Standards

README.md

@@ -2,12 +2,19 @@
 
 Self-hosted web app for designing, saving, and printing labels to Brother QL series printers.
 
-**Status**: Released (v0.1.1) — all v1 features are working and the app is packaged as a single Docker image.
+**Status**: Released (v0.1.2) — all v1 features are working and the app is packaged as a single Docker image.
 
-**Version:** 0.1.1
+**Version:** 0.1.2
 
 ## What's New
 
+### v0.1.2 (2026-06-07)
+
+Fixes the published container image. Builds were producing an OCI index with provenance/SBOM
+attestation child manifests; the weekly image cleanup deleted those untagged children, leaving
+`:latest`/`:v0.1.1` pointing at a missing manifest (`docker pull` → 404). The image is now a
+plain single-platform manifest and the cleanup keeps a safety buffer, so pulls work again.
+
 ### v0.1.1 (2026-06-06)
 
 Deployment reliability. Startup now logs in detail (version, effective config, data directory,

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "labelforge"
-version = "0.1.1"
+version = "0.1.2"
 description = "Self-hosted web app for printing labels to Brother QL series printers"
 readme = "README.md"
 requires-python = ">=3.12"