ci(main): make latest explicit-only, immune to auto-tagging - #46
Merged
Conversation
docker/metadata-action defaults to flavor: latest=auto, which auto-adds a latest tag on tag pushes since type=ref,event=tag is present. Set flavor: latest=false so latest is only produced by the explicit type=raw,value=latest entry below, which tracks resolute (main) releases and can no longer be overridden by auto-tagging logic on another branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
The
mergejob's "Create tags for publishing image" step usesdocker/metadata-actionwith noflavor:input, so it falls back to the action defaultflavor: latest=auto. Because the tag list includestype=ref,event=tag, any tag push whose version isn't pre-release semver auto-generates alatesttag — meaninglatestcan be won by whichever branch releases most recently (e.g. a noble release), not just resolute (main) releases.Fix
Add
flavor: latest=falseto disable the automaticlatesttag. The existing explicittype=raw,value=latestentry in thetags:list is kept, solatestis still produced on everymain(resolute) release — it's just no longer producible by the auto-tagging heuristic, so another branch's release can't steal it. Theresoluteand26.04tags are unchanged.Follow-up (not done in this PR)
Live
latestin GHCR still points at the noble image from today's release; it will self-correct on the next resolute (main) release, or an admin can re-point it manually. This PR only stops future noble releases from stealing it.Companion PR
A matching PR targeting
nobleaddsflavor: latest=falseto that branch's metadata-action step too, since noble's tag list currently still includestype=ref,event=tagand would otherwise still auto-generatelateston its own.Generated by Claude Code