ci(noble): stop noble releases from tagging latest - #45
Merged
Conversation
docker/metadata-action defaults to flavor: latest=auto, which auto-adds a latest tag on tag pushes since type=ref,event=tag is present and noble-* tags are not pre-release semver. Set flavor: latest=false so noble releases no longer overwrite latest in GHCR.
There was a problem hiding this comment.
Pull request overview
Disables Docker metadata-action’s automatic latest tag generation for noble (Ubuntu 24.04) release tags, preventing noble releases from overwriting latest in GHCR and ensuring latest remains explicitly managed by the intended release line.
Changes:
- Add
flavor: latest=falsetodocker/metadata-action@v6solatestis not auto-produced on noble tag pushes. - Keep the existing explicit tag set for noble releases (
type=ref,event=tag,noble,24.04) unchanged.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
The
mergejob's "Create tags for publishing image" step usesdocker/metadata-actionwith noflavor:input, so it falls back to the action defaultflavor: latest=auto. Because the tag list includestype=ref,event=tagandnoble-*release tags (e.g.noble-20260610) are not pre-release semver,latest=autoauto-generates alatesttag on every noble tag push. That overwriteslatestin GHCR to point at the Ubuntu 24.04 (noble) image, even though only the resolute (Ubuntu 26.04,main) release should ownlatest.Fix
Add
flavor: latest=falseto the metadata-action step to disable the automaticlatesttagging. The existing explicittags:list (noble,24.04, and the ref tag) is unchanged — noble releases still get tagged correctly, they just no longer also steallatest.Follow-up (not done in this PR)
Live
latestin GHCR still points at the noble image from today's release; it will self-correct on the next resolute (main) release, or an admin can re-point it manually. This PR only stops future noble releases from stealing it.Companion PR
A matching PR targeting
mainadds the sameflavor: latest=falsethere too, solatestbecomes explicit-only (produced solely by thetype=raw,value=latestentry that tracks resolute releases) and is immune to auto-tagging regardless of which branch releases.Generated by Claude Code