[wimaha]

What

New workflow .github/workflows/pr-image.yml: every pull request from a branch of this repository gets a multi-platform Docker image wimaha/tesla-ble-http-proxy:pr-<number> (linux/amd64, arm64, arm/v6, arm/v7). With it, an unmerged change can be tested on a Raspberry Pi with a plain docker pull instead of docker save/scp.

• Runs on pull_request opened/synchronize/reopened, only when head.repo.full_name == github.repository. Forks have no secrets and are skipped.
• One concurrency group per PR: a newer push cancels an older build.
• Builds the PR's head commit (not the merge commit with main), so the image is exactly what was pushed.
• Only ever tags pr-<number>. :latest, :dev and version tags are never touched.
• On close, a cleanup job deletes the tag via the Docker Hub API (404 counts as fine).

Needs checking

• The cleanup job needs DOCKER_PASS to be a Docker Hub access token with Read, Write, Delete scope. Without it, the job fails and the tag has to be deleted by hand.
• This PR builds its own image, so it tests the build job. The cleanup job runs when the PR is closed.

Docs

• README: new subsection "Test images for pull requests" under "Build yourself".
• CHANGELOG: entry under Unreleased → Added.

actionlint passes.

🤖 Generated with Claude Code

[github-actions]

🟡 Merge after the to-dos

This only adds a CI workflow and docs. The proxy code, API and the :latest image are not touched. One thing must be checked first: the Docker Hub token.

Impact on existing users: None – the change is additive. Only the new pr-<number> tags are written; :latest, :dev and version tags are not.

To-do for the author

• Check that the DOCKER_PASS secret is a token with Read, Write, Delete scope. If not, the cleanup job fails and old pr-* tags stay on Docker Hub.
• Make a failed Docker Hub login visible in the cleanup job (right now it ends with no clear message).

Test before merging: Let this PR build its own image, pull pr-175 on a Pi (arm) and start it. Then close the PR and check that the tag is gone.

Technical details

• .github/workflows/pr-image.yml (cleanup step): the login curl uses -sf. If login fails, token is empty or the script stops silently. Add a check like [ -n "$token" ] || { echo "Docker Hub login failed"; exit 1; }. Also consider echo "::add-mask::$token".
• Same file: a same-repo branch runs its own copy of the workflow with the Docker secrets. Only people with write access can do this, so the risk is low. Just be aware that any collaborator can publish tags into the production image repo. A separate repo or a separate token would limit this.
• The concurrency group is shared by build and cleanup. Closing a PR cancels a running build, which is the wanted result.
• Not verified: the real scope of DOCKER_PASS, and whether the arm/v6 build works on ubuntu-latest in time. I could not run the workflow.