fix(publish): bump checkout to v6, gate :main tag on ref, add build-args parity (LOW-3)

Author: bwlkr

.github/workflows/publish-image.yaml

@@ -46,7 +46,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Install cosign
         uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
@@ -67,7 +67,7 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=main
+            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
             type=sha,prefix=sha-
             type=raw,value=${{ inputs.version }}
             type=raw,value=v${{ inputs.version }}

.github/workflows/publish-node-image.yaml

@@ -42,6 +42,11 @@ on:
         required: false
         type: string
         default: .
+      build-args:
+        description: Docker build arguments (newline-separated KEY=VALUE)
+        required: false
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -54,7 +59,7 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Check out repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Setup Node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
@@ -87,7 +92,7 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            type=raw,value=main
+            type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
             type=sha,prefix=sha-
             type=raw,value=${{ inputs.version }}
             type=raw,value=v${{ inputs.version }}
@@ -102,6 +107,7 @@ jobs:
           platforms: ${{ inputs.platforms }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          build-args: ${{ inputs.build-args }}
 
       - name: Sign image with cosign
         env: