luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(08-fix): WR-04 push immutable sha tag before :latest with strict shell

Browse Source
This commit is contained in:
Lucas Berger
2026-06-11 19:27:07 -04:00
parent 58861d99a8
commit 4001cd5b90
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/publish.yml
+7 -2
View File
@@ -76,13 +76,18 @@ jobs:
# lockfile from the root context; building from apps/api/ would fail to find them. # lockfile from the root context; building from apps/api/ would fail to find them.
- name: Build and push - name: Build and push
run: | run: |
set -euo pipefail
docker build --target production \ docker build --target production \
-f apps/api/Dockerfile \ -f apps/api/Dockerfile \
-t ${{ steps.tags.outputs.latest }} \ -t ${{ steps.tags.outputs.latest }} \
-t ${{ steps.tags.outputs.sha_tag }} \ -t ${{ steps.tags.outputs.sha_tag }} \
. .
docker push ${{ steps.tags.outputs.latest }} # Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on
docker push ${{ steps.tags.outputs.sha_tag }} # the first failed push, so :latest is only moved after the immutable,
# rollback-traceable tag has landed — a failed second push can never leave
# :latest advanced without a corresponding rollback tag (WR-04).
docker push ${{ steps.tags.outputs.sha_tag }} # immutable first
docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands
# Always drop the stored credential from the runner after push (defence in depth). # Always drop the stored credential from the runner after push (defence in depth).
- name: Docker logout - name: Docker logout