From 6bcf867e6c26456d669c051200334e5f1c6fe08b Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Thu, 11 Jun 2026 19:26:53 -0400
Subject: [PATCH] fix(08-fix): WR-03 fail closed on empty GITHUB_SHA when
 computing image tags

---
 .gitea/workflows/publish.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitea/workflows/publish.yml b/.gitea/workflows/publish.yml
index d6a2449..001de32 100644
--- a/.gitea/workflows/publish.yml
+++ b/.gitea/workflows/publish.yml
@@ -41,6 +41,12 @@ jobs:
       - name: Compute image tags
         id: tags
         run: |
+          set -euo pipefail
+          # Fail closed if GITHUB_SHA is empty/unset (Gitea runner env parity is not
+          # guaranteed across versions). Without this guard SHORT_SHA degrades to ""
+          # and the immutable tag silently becomes :v1.1- — a valid-but-wrong tag that
+          # overwrites the milestone pointer and destroys rollback traceability (WR-03).
+          : "${GITHUB_SHA:?GITHUB_SHA is empty — refusing to build a malformed image tag}"
           SHORT_SHA=${GITHUB_SHA:0:7}
           MILESTONE="${{ env.MILESTONE }}"
           echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT