gitignore data/ — it holds face embeddings keyed by real names

data/ is the DATA_DIR the README tells you to mount, and it was not ignored: it holds 1,593
face-embedding .npy files plus upload trackers keyed by person name. A single 'git add -A'
would have published them. Never committed to date, so history is clean.

.github/workflows/docker-publish.yml

@@ -79,7 +79,7 @@ jobs:
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
@@ -222,7 +222,7 @@ jobs:
           fi
 
       - name: Build and push CPU image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
@@ -305,7 +305,7 @@ jobs:
           fi
 
       - name: Build and push ROCm image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
@@ -388,7 +388,7 @@ jobs:
           fi
 
       - name: Build and push Intel image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile

.gitignore

@@ -34,3 +34,7 @@ wheels/
 .pytest_cache/
 .mypy_cache/
 .python-version
+
+# Runtime data: face embeddings + upload trackers keyed by real person names.
+# Never commit — this is the DATA_DIR the README tells you to mount.
+data/