From 2cb7255d1bffbdcce497f7a00e958e0683e041ab Mon Sep 17 00:00:00 2001 From: sebasnallar Date: Wed, 26 Aug 2026 10:00:56 -0300 Subject: [PATCH] fix(release-publish-oci): build the tag's code, not the run's checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The chained pipeline always runs on the main branch — that is what makes it trigger at all — so docker-build-push-ecr's default checkout (the triggering commit) builds main. For a fresh release that coincides with the tagged commit, but in existing_tag recovery or backfill mode main has moved on: the image would carry the old tag over new code. Add a `ref` input to docker-build-push-ecr (empty = triggering commit, fully backward compatible) and have release-publish-oci pass the tag being published in both modes. Co-Authored-By: Claude Fable 5 --- .github/workflows/docker-build-push-ecr.yml | 8 ++++++++ .github/workflows/release-publish-oci.yml | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/.github/workflows/docker-build-push-ecr.yml b/.github/workflows/docker-build-push-ecr.yml index 509905a..0c87108 100644 --- a/.github/workflows/docker-build-push-ecr.yml +++ b/.github/workflows/docker-build-push-ecr.yml @@ -46,6 +46,11 @@ on: required: false type: string default: '' + ref: + description: 'Git ref to check out and build (tag/branch/SHA). Empty = the commit that triggered the run. Pass the tag being published whenever the run context is not the tag itself (e.g. chained release pipelines running on main).' + required: false + type: string + default: '' outputs: image_digest: description: 'OCI image-index digest (sha256:...)' @@ -75,6 +80,9 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@v6 + with: + # Empty ref = actions/checkout default (the triggering commit). + ref: ${{ inputs.ref }} - name: Set up QEMU uses: docker/setup-qemu-action@v4 diff --git a/.github/workflows/release-publish-oci.yml b/.github/workflows/release-publish-oci.yml index 0ec79d7..850b0cd 100644 --- a/.github/workflows/release-publish-oci.yml +++ b/.github/workflows/release-publish-oci.yml @@ -196,6 +196,11 @@ jobs: build_args: ${{ inputs.build_args }} also_tag_latest: ${{ inputs.also_tag_latest }} tag: ${{ inputs.existing_tag || needs.release.outputs.tag_name }} + # Build the TAG's code, not the run's checkout. The run always sits on + # the main branch (that is what makes the chain trigger at all), which + # coincides with the tagged commit for a fresh release — but never for + # an existing_tag recovery/backfill, where main has moved on. + ref: ${{ inputs.existing_tag || needs.release.outputs.tag_name }} secrets: aws_role_arn: ${{ secrets.aws_role_arn }}