2026-06-11 19:40:45 -04:00
1 changed files with 6 additions and 0 deletions
@@ -41,6 +41,12 @@ jobs:
      - name: Compute image tags
        id: tags
        run: |
+          set -euo pipefail
+          # Fail closed if GITHUB_SHA is empty/unset (Gitea runner env parity is not
+          # guaranteed across versions). Without this guard SHORT_SHA degrades to ""
+          # and the immutable tag silently becomes :v1.1- — a valid-but-wrong tag that
+          # overwrites the milestone pointer and destroys rollback traceability (WR-03).
+          : "${GITHUB_SHA:?GITHUB_SHA is empty — refusing to build a malformed image tag}"
          SHORT_SHA=${GITHUB_SHA:0:7}
          MILESTONE="${{ env.MILESTONE }}"
          echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT