[vitormattos]

Problem

The two merges on 25 October 2026 triggered independent Build and Publish Docker Images workflows for main. Both published the same mutable :3 tag:

• Commit 51464ad (PR fix(nginx): preserve public Host port and deny Core source access #55) completed at 00:29:07 UTC.
• The older commit 4b4bf32 (PR fix(dev): retain reviewed Akaunting 3.2.4 patches and local homologation #56) completed later, at 00:29:32 UTC.

Comparing GHCR manifest digests confirmed that both akaunting-docker-php:3 and akaunting-docker-nginx:3 ended up pointing to sha-4b4bf32, rather than the latest main image sha-51464ad. A new deployment that pulls :3 can therefore miss the Nginx Host-header fix from #55, even though both builds succeeded.

Change

Add GitHub Actions workflow-level concurrency keyed by workflow and Git ref, with cancel-in-progress: true. A newer push to main cancels an obsolete publisher for that ref, so older commits cannot complete after newer ones and overwrite the mutable version tag. Pull requests use their own refs and do not publish images.

This is a minimal workflow-only change: no new scripts, registry permissions, dependencies, or Dockerfile changes.

Verification

• Reproduced the publication race from the two successful workflow runs and GHCR manifest digests.
• Parsed the amended workflow as YAML and confirmed the patch applies cleanly to the current main.
• Commit is cryptographically signed and DCO-compliant.
• GitHub Actions must still validate the new workflow; final publication ordering will be proven by the next sequence of pushes.

Deployment and scope

The local NFS-e homologation is temporarily pinned to the verified immutable images sha-51464ad; no existing containers, databases, or production deployments are changed by this PR.

After merge: the ensuing main publish should also restore the :3 aliases to the latest commit. Confirm the registry digests after CI completes before recommending consumers update their images.