Fix/fix actions (#29)

* Change PR event trigger to `pull_request`, it is a public repo

* Add suffix `reusable` to reusable docker workflow

* Set `latest` tag to latest main build

.github/workflows/auto-merge.yaml

@@ -1,5 +1,5 @@
 name: Dependabot auto-approve
-on: pull_request_target
+on: pull_request
 
 permissions:
   pull-requests: write

.github/workflows/publish-docker-dev.yaml

@@ -6,13 +6,13 @@ on:
     - main
     paths:
     - 'dev/Dockerfile'
-  pull_request_target:
+  pull_request:
     paths:
     - 'dev/Dockerfile'
   workflow_dispatch:
 
 jobs:
   buildAndPush:
-    uses: ./.github/workflows/publish-docker.yaml
+    uses: ./.github/workflows/publish-docker-reusable.yaml
     with:
       image: dev

.github/workflows/publish-docker-images.yaml

@@ -8,14 +8,14 @@ on:
     - v*
     paths:
     - 'base/Dockerfile'
-  pull_request_target:
+  pull_request:
     paths:
     - 'base/Dockerfile'
   workflow_dispatch:
 
 jobs:
   buildAndPushBase:
-    uses: ./.github/workflows/publish-docker.yaml
+    uses: ./.github/workflows/publish-docker-reusable.yaml
     with:
       image: base
 
@@ -27,6 +27,6 @@ jobs:
         - name: dev
         - name: net
       max-parallel: 2
-    uses: ./.github/workflows/publish-docker.yaml
+    uses: ./.github/workflows/publish-docker-reusable.yaml
     with:
       image: ${{ matrix.image.name }}

.github/workflows/publish-docker-net.yaml

@@ -6,13 +6,13 @@ on:
     - main
     paths:
     - 'net/Dockerfile'
-  pull_request_target:
+  pull_request:
     paths:
     - 'net/Dockerfile'
   workflow_dispatch:
 
 jobs:
   buildAndPush:
-    uses: ./.github/workflows/publish-docker.yaml
+    uses: ./.github/workflows/publish-docker-reusable.yaml
     with:
       image: net

.github/workflows/publish-docker.yaml → .github/workflows/publish-docker-reusable.yaml

@@ -28,6 +28,7 @@ jobs:
           type=ref,event=tag
           type=ref,event=pr
           type=sha
+          type=raw,value=latest,enable=${{ is_default_branch }}
         flavor: |
           latest=auto
     - name: Set up QEMU
@@ -48,7 +49,7 @@ jobs:
         version: latest
         endpoint: builders # self-hosted
     - name: Login to GHCR
-      if: github.event_name != 'pull_request_target'
+      if: github.event_name != 'pull_request'
       uses: docker/login-action@v3
       with:
         registry: ghcr.io
@@ -60,7 +61,7 @@ jobs:
       with:
         context: ${{ inputs.image }}
         platforms: ${{ env.platforms }}
-        push: ${{ github.event_name != 'pull_request_target' }}
+        push: ${{ github.event_name != 'pull_request' }}
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
         secrets: |

.github/workflows/release-drafter.yaml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
     - main
-  pull_request_target:
+  pull_request:
 
 jobs:
   update_release_draft: