From f341e7c34cf13f4dae34e63b04155171d69a2f5f Mon Sep 17 00:00:00 2001 From: sebasnallar Date: Thu, 3 Sep 2026 19:11:39 -0300 Subject: [PATCH 1/2] fix(docker-build-push-ecr): build backfills from the tag, not the dispatch branch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The checkout was bare, so an existing_tag recovery dispatch built the image from the branch that dispatched it instead of the tagged commit — correct only when they coincide. Adds an optional ref input (empty = triggering ref, preserving normal behavior) and passes existing_tag through from release-publish-oci's publish call. Co-Authored-By: Claude Fable 5 --- .github/workflows/docker-build-push-ecr.yml | 8 ++++++++ .github/workflows/release-publish-oci.yml | 3 +++ 2 files changed, 11 insertions(+) diff --git a/.github/workflows/docker-build-push-ecr.yml b/.github/workflows/docker-build-push-ecr.yml index 09f81bd..1676aad 100644 --- a/.github/workflows/docker-build-push-ecr.yml +++ b/.github/workflows/docker-build-push-ecr.yml @@ -15,6 +15,11 @@ on: description: 'Check out git submodules before building (the build context includes them)' required: false type: boolean + ref: + description: 'Git ref to build from (branch, tag or SHA). Empty = the ref that triggered the run — pass the tag on recovery/backfill dispatches, or the image is built from the dispatched branch instead of the tagged commit' + required: false + type: string + default: '' default: false dockerfile: description: 'Path to Dockerfile relative to context' @@ -82,6 +87,9 @@ jobs: uses: actions/checkout@v6 with: submodules: ${{ inputs.submodules }} + # Empty ref = default (the triggering ref); backfills pass the tag so + # the image content matches the tagged commit, not the dispatch branch. + ref: ${{ inputs.ref }} - name: Set up QEMU uses: docker/setup-qemu-action@v4 diff --git a/.github/workflows/release-publish-oci.yml b/.github/workflows/release-publish-oci.yml index 5e01256..3ae4333 100644 --- a/.github/workflows/release-publish-oci.yml +++ b/.github/workflows/release-publish-oci.yml @@ -188,6 +188,9 @@ jobs: uses: ./.github/workflows/docker-build-push-ecr.yml with: image_name: ${{ inputs.image_name }} + # On existing_tag backfills the run is dispatched from a branch — build + # from the tag's commit, not the branch head. + ref: ${{ inputs.existing_tag || '' }} context: ${{ inputs.context }} dockerfile: ${{ inputs.dockerfile }} platforms: ${{ inputs.platforms }} From 1b58fc446711851b944e661df7feacfdcef451c2 Mon Sep 17 00:00:00 2001 From: sebasnallar Date: Fri, 4 Sep 2026 12:16:29 -0300 Subject: [PATCH 2/2] fix: restore submodules default displaced by the ref input insertion Co-Authored-By: Claude Fable 5 --- .github/workflows/docker-build-push-ecr.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-build-push-ecr.yml b/.github/workflows/docker-build-push-ecr.yml index 1676aad..a723523 100644 --- a/.github/workflows/docker-build-push-ecr.yml +++ b/.github/workflows/docker-build-push-ecr.yml @@ -15,12 +15,12 @@ on: description: 'Check out git submodules before building (the build context includes them)' required: false type: boolean + default: false ref: description: 'Git ref to build from (branch, tag or SHA). Empty = the ref that triggered the run — pass the tag on recovery/backfill dispatches, or the image is built from the dispatched branch instead of the tagged commit' required: false type: string default: '' - default: false dockerfile: description: 'Path to Dockerfile relative to context' required: false