Missing latest tag on type=match

[comminutus]

Contributing guidelines

• [X] I've read the contributing guidelines and wholeheartedly agree

I've found a bug, and:

• [X] The documentation does not mention anything about my problem
• [X] There are no open or closed issues that are related to my problem

Description

Problem

The readme mentions that the latest tag ought to be generated when flavor.latest is set to auto:

[type=ref,event=tag](https://github.com/docker/metadata-action#typeref)
[type=semver,pattern=...](https://github.com/docker/metadata-action#typesemver)
[type=match,pattern=...](https://github.com/docker/metadata-action#typematch)

However, when I push a tag in the format of v#.##.#-extra-1 (which the match supposedly matches), the latest tag isn't added.

Expected behaviour

Configuration

Build URL:

Expected behaviour

The latest tag should be added on any match hit

Actual behaviour

No latest tag is generated

Repository URL

https://github.com/comminutus/p2pool-alpine

Workflow run URL

https://github.com/comminutus/p2pool-alpine/actions/runs/7624668710

YAML workflow

name: CI

on:
  schedule:
    - cron: 0 8 * * *
  push:
    branches:
      - master
    tags:
      - v*.*.*
  pull_request:
    branches:
      - master

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@v3 #v3.1.1
        with:
          cosign-release: 'v2.1.1'

      # Set up BuildKit Docker container builder to be able to build
      # multi-platform images and export cache
      # https://github.com/docker/setup-buildx-action
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3 # v3.0.0

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v5 # v5.0.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}},prefix=v
            type=semver,pattern={{major}}.{{minor}},prefix=v
            type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v
            type=match,pattern=\d+\.\d+\.\d+,prefix=v
            type=match,pattern=\d+\.\d+,prefix=v
            type=match,pattern=\d+,prefix=v,enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }},prefix=v
            type=ref,event=branch
            type=ref,event=tag
            type=ref,event=pr
            type=schedule
            type=raw,value=${{ github.sha }}
            type=edge,branch=master

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v5 # v5.0.0
        with:
          context: .
          file: Containerfile
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.event_name != 'pull_request' }}
        env:
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TAGS: ${{ steps.meta.outputs.tags }}
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

  vulnerability-scan:
    name: Vulnerability Scan
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: template
          template: '@/contrib/sarif.tpl'
          output: trivy-results.sarif
          # severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: trivy-results.sarif

  tagged-release:
    name: Tagged Release
    needs: build
    runs-on: ubuntu-latest

    steps:
      - uses: marvinpinto/action-automatic-releases@v1.2.1
        if: |
          startsWith(github.ref, 'refs/tags/v') &&
          github.event_name == 'push'
        with:
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          prerelease: false

### Workflow logs

[
[logs_14.zip](https://github.com/docker/metadata-action/files/14022626/logs_14.zip)
](url)

### BuildKit logs

_No response_

### Additional info

_No response_

[comminutus]

I figured this out. By default the semver priority is higher than the match priority. Since my tag, in the form of v##.##.##-me-#, is technically a valid semver, the -me-# portion is considered a pre-release and thus would not get a latest tag. By either removing the semver inputs or by placing the match priority higher than semver, the latest tag gets added.