From 028ced65840ab16071f928c9c6bb7395861c00f8 Mon Sep 17 00:00:00 2001
From: null-paorodrigues <paola.rodrigues@nullplatform.io>
Date: Wed, 19 Aug 2026 15:48:40 -0300
Subject: [PATCH] fix(docker-ecr): keep prerelease suffix in the published
 image tag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The version was extracted with an unanchored `grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+'`.
Because `v1.2.3-beta` contains `v1.2.3` as a substring, the match dropped the
suffix and the image was pushed as `:v1.2.3` — a prerelease squatting the
release tag, with the digest registered against the wrong version.

Replace the extraction with an anchored match that separates an optional
monorepo prefix from the full SemVer, so prerelease and build metadata survive.
Tags that aren't semver-shaped (`beta`, `latest`) still pass through untouched,
and `logs-controller-v2.0.0 -> v2.0.0` keeps working.

Also expose the resolved tag as a new `image_tag` output. Callers that need to
reference the pushed image (e.g. an overlay image doing `FROM <base>:<tag>`)
were passing `github.ref_name` and assuming the reusable does not transform it,
which is exactly the assumption that broke here.

Verified against the real tag inputs of every caller of this workflow: no
change in behaviour for any of them other than the prerelease case.
---
 .github/workflows/docker-build-push-ecr.yml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-build-push-ecr.yml b/.github/workflows/docker-build-push-ecr.yml
index 55c08e2..509905a 100644
--- a/.github/workflows/docker-build-push-ecr.yml
+++ b/.github/workflows/docker-build-push-ecr.yml
@@ -50,6 +50,9 @@ on:
       image_digest:
         description: 'OCI image-index digest (sha256:...)'
         value: ${{ jobs.build-and-push.outputs.digest }}
+      image_tag:
+        description: 'Tag the image was actually pushed with (after prefix stripping)'
+        value: ${{ jobs.build-and-push.outputs.version }}
     secrets:
       aws_role_arn:
         description: 'AWS IAM Role ARN for OIDC authentication'
@@ -65,6 +68,7 @@ jobs:
     runs-on: ubuntu-24.04
     outputs:
       digest: ${{ steps.digest.outputs.digest }}
+      version: ${{ steps.tags.outputs.version }}
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -101,8 +105,16 @@ jobs:
             exit 1
           fi
 
-          # Extract version from tag (e.g., logs-controller-v2.0.0 -> v2.0.0)
-          VERSION=$(echo "${TAG}" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' || echo "${TAG}")
+          # Strip an optional monorepo prefix from the tag (logs-controller-v2.0.0
+          # -> v2.0.0) while keeping the SemVer intact, prerelease and build
+          # metadata included: v1.2.3-beta must NOT collapse to v1.2.3, or a
+          # prerelease would squat the release tag. The match is anchored, so
+          # tags that aren't semver-shaped (beta, latest) pass through untouched.
+          if [[ "${TAG}" =~ ^(.*-)?(v?[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?)$ ]]; then
+            VERSION="${BASH_REMATCH[2]}"
+          else
+            VERSION="${TAG}"
+          fi
           TAGS="${REGISTRY}/${IMAGE}:${VERSION}"
 
           if [ "${{ inputs.also_tag_latest }}" = "true" ]; then
@@ -110,6 +122,7 @@ jobs:
           fi
 
           echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Generated tags: ${TAGS}"
 
       - name: Build and push Docker image