Tag builds with the commit SHA to avoid implicit upgrades

Author: rcrowley

.github/workflows/build.yml

@@ -35,6 +35,7 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: type=sha
 
       - id: push
         name: Build and push Docker image