- check job runs go vet, go build and go test -short before the build - images are pushed as :<tag> and :sha-<12>; :latest moves only on tag pushes - GIT_COMMIT build arg and OCI source/created labels Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>