- Grafana (GF_SERVER_ENFORCE_DOMAIN=true) 301-redirects API calls to the
canonical https:// domain; Go TLS verification of the redirected request
needs a CA bundle, which scratch lacks. Copy ca-certificates.crt into
the final image.
- workflow_dispatch gains a 'suffix' input so the same upstream version
can be rebuilt under a new tag (v1.1.0-1) without mutating v1.1.0.