[cliffhall]

Closes #2958

A v1 release moved the GHCR image's latest tag to v1. After 1.0.5, ghcr.io/modelcontextprotocol/inspector:latest resolved to the 1.0.5 image (sha256:59726800…6a73), not 2.14.0.

Change

publish-github-container-registry ran docker/metadata-action@v6 with only images:, so its default flavor: latest=auto added latest next to the version tag on every tag event. This sets flavor: latest=false on the Extract metadata step, with a comment saying why it must stay. The version tag (type=ref,event=tag, for example 1.0.5) is unchanged. It's the GHCR counterpart of publish-all's --tag v1-latest on npm.

Not in this PR

• latest itself is restored by the next v2 release: main's workflow sets flavor: latest=true explicitly.
• No v1 release is needed to ship this. The workflow runs from the tagged commit, so it takes effect for the next v1 release cut after it merges.

Checks

• prettier --check .github/workflows/main.yml: passes.
• The change only runs on a release event, so it can't be exercised on this PR. The PR's own build and test jobs confirm the file still parses.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Repository guidance reserves the deprecated v1/main branch for maintainer-handled security fixes, so this non-security release-workflow change requires maintainer authorization.

No open issues 🎉

What changed in this PR

Prevents future v1 releases from overwriting the GHCR image’s latest tag, keeping deprecated v1 images from replacing v2 as the default pull target.

Changes:

• Sets flavor: latest=false for container metadata generation while preserving version tags.
• Adds a comment explaining why the guard must remain, referencing #2958 and npm’s existing v1 tagging policy.

File	Description
.github/​workflows/​main.yml	Disables automatic latest tagging for v1 container releases and documents the reason.

_{Review effort: Balanced}

[cliffhall]

Re the review note on v1/main's scope: this is maintainer-authorized. It isn't a v1 feature. It stops a v1 release from re-pointing GHCR's latest at deprecated v1, which currently hands v1 to anyone pulling ghcr.io/modelcontextprotocol/inspector without a tag. That's the same release-integrity guard publish-all's --tag v1-latest already provides on npm. No inline findings to address.