From 4001cd5b90ad299d76becd36257d58533e7f5065 Mon Sep 17 00:00:00 2001 From: Lucas Berger Date: Thu, 11 Jun 2026 19:27:07 -0400 Subject: [PATCH] fix(08-fix): WR-04 push immutable sha tag before :latest with strict shell --- .gitea/workflows/publish.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml index 5817349..2e12f90 100644 --- a/.gitea/workflows/publish.yml +++ b/.gitea/workflows/publish.yml @@ -76,13 +76,18 @@ jobs: # lockfile from the root context; building from apps/api/ would fail to find them. - name: Build and push run: | + set -euo pipefail docker build --target production \ -f apps/api/Dockerfile \ -t ${{ steps.tags.outputs.latest }} \ -t ${{ steps.tags.outputs.sha_tag }} \ . - docker push ${{ steps.tags.outputs.latest }} - docker push ${{ steps.tags.outputs.sha_tag }} + # Push the IMMUTABLE :- tag FIRST. set -euo pipefail stops on + # the first failed push, so :latest is only moved after the immutable, + # rollback-traceable tag has landed — a failed second push can never leave + # :latest advanced without a corresponding rollback tag (WR-04). + docker push ${{ steps.tags.outputs.sha_tag }} # immutable first + docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands # Always drop the stored credential from the runner after push (defence in depth). - name: Docker logout