ci: publish a clean :latest tag, drop cosign signing

The package page showed a sha256 hash instead of a usable tag. cosign
pushes a separate artifact per build, tagged sha256-<digest>.sig, and
because it goes up after the image it was the newest entry. Sixty-odd
nightly runs had filled the listing with them.

Dropping the signing step leaves :latest visible. The tradeoff is real:
published images are no longer signed against the sigstore log. There's no
way to keep cosign and hide its artifacts, since GHCR renders them as
ordinary versions, so it's signing against a readable package page.

Also makes the tagging explicit instead of relying on the action default.
latest=auto moves :latest onto any pushed vX.Y.Z tag.

Version goes to 2.0.0: storage moved to a new key format, migrated on
first open, and Backspace no longer deletes.

Removes the analytics tag from index.html.

.github/workflows/docker-publish.yml

@@ -27,9 +27,6 @@ jobs:
     permissions:
       contents: read
       packages: write
-      # This is used to complete the identity challenge
-      # with sigstore/fulcio when running outside of PRs.
-      id-token: write
 
     steps:
       - name: Checkout repository
@@ -39,14 +36,6 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
 
-      # Install the cosign tool except on PR
-      # https://github.com/sigstore/cosign-installer
-      - name: Install cosign
-        if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
-        with:
-          cosign-release: 'v2.2.4'
-
       # Set up BuildKit Docker container builder to be able to build
       # multi-platform images and export cache
       # https://github.com/docker/setup-buildx-action
@@ -70,13 +59,17 @@ jobs:
         uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          # latest=auto also moves :latest onto any pushed vX.Y.Z tag, so the
+          # tag people actually pull tracks the newest release as well as main.
+          flavor: |
+            latest=auto
           tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
             type=ref,event=branch
             type=ref,event=pr
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=raw,value=latest,enable={{is_default_branch}}
 
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
@@ -91,18 +84,3 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-
-      # Sign the resulting Docker image digest except on PRs.
-      # This will only write to the public Rekor transparency log when the Docker
-      # repository is public to avoid leaking data.  If you would like to publish
-      # transparency data even for private images, pass --force to cosign below.
-      # https://github.com/sigstore/cosign
-      - name: Sign the published Docker image
-        if: ${{ github.event_name != 'pull_request' }}
-        env:
-          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
-          TAGS: ${{ steps.meta.outputs.tags }}
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        # This step uses the identity token to provision an ephemeral certificate
-        # against the sigstore community Fulcio instance.
-        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "negotium-todo",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "negotium-todo",
-      "version": "1.0.0",
+      "version": "2.0.0",
       "license": "MIT",
       "devDependencies": {
         "@sveltejs/vite-plugin-svelte": "^7.3.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "negotium-todo",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "A clean, minimal to-do list application with smooth animations and dark/light mode support",
   "type": "module",
   "main": "index.html",