From 97a661d04fd4ec518e36c66bf6a6291793242c5c Mon Sep 17 00:00:00 2001
From: ajnart <49837342+ajnart@users.noreply.github.com>
Date: Sat, 11 Jul 2026 12:17:41 +0200
Subject: [PATCH] fix(ci): apply CodeRabbit review fixes

- Rename tag prefix from omar-test-pr- to pr-
- Add contents: read permission to publish workflow
- Disable persist-credentials on checkout step
---
 .github/workflows/on-pr-docker-cleanup.yml | 2 +-
 .github/workflows/on-pr-docker-publish.yml | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/on-pr-docker-cleanup.yml b/.github/workflows/on-pr-docker-cleanup.yml
index c390d635e..8a6cae092 100644
--- a/.github/workflows/on-pr-docker-cleanup.yml
+++ b/.github/workflows/on-pr-docker-cleanup.yml
@@ -11,7 +11,7 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_TAG: omar-test-pr-${{ github.event.number }}
+  IMAGE_TAG: pr-${{ github.event.number }}
 
 jobs:
   delete-image:
diff --git a/.github/workflows/on-pr-docker-publish.yml b/.github/workflows/on-pr-docker-publish.yml
index b42312a52..0a5941c88 100644
--- a/.github/workflows/on-pr-docker-publish.yml
+++ b/.github/workflows/on-pr-docker-publish.yml
@@ -7,6 +7,7 @@ on:
       - dev
 
 permissions:
+  contents: read
   packages: write
 
 env:
@@ -26,6 +27,8 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Docker meta
         id: meta
@@ -33,7 +36,7 @@ jobs:
         with:
           images: "${{ env.GHCR_REPO }}"
           tags: |
-            type=raw,value=omar-test-pr-${{ github.event.number }}
+            type=raw,value=pr-${{ github.event.number }}
 
       - name: Log in to the Container registry
         uses: docker/login-action@v4