From c045e9b74ff549c524dcdb0ca48dfbebf973b32e Mon Sep 17 00:00:00 2001 From: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 Date: Sat, 20 Jun 2026 15:35:27 -0400 Subject: [PATCH] fix(ci): publish versioned Docker tags via auto-tag dispatch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Auto-tagged releases never published versioned container images. The release tag is pushed with the default GITHUB_TOKEN, and GitHub's recursion guard suppresses all on:push triggers for GITHUB_TOKEN-pushed refs, so docker.yml's on:push:tags trigger never fired. Only :main and :latest existed; every ghcr.io/block/buzz:vX.Y.Z returned 404. Mirror the rescue release.yml already uses: auto-tag now dispatches docker.yml with version+ref. On dispatch github.ref is main, so the tag ref is plumbed through explicitly — checkout pins to inputs.ref and the type=semver tags take inputs.version via metadata-action value=. An empty value= is a no-op on the native push-tag path (procSemver falls back to the git ref), so human-pushed tags and inputless canary dispatches are unchanged. Co-authored-by: Will Pfleger Signed-off-by: Will Pfleger --- .../auto-tag-on-release-pr-merge.yml | 12 +++++++ .github/workflows/docker.yml | 36 +++++++++++++++---- 2 files changed, 41 insertions(+), 7 deletions(-) diff --git a/.github/workflows/auto-tag-on-release-pr-merge.yml b/.github/workflows/auto-tag-on-release-pr-merge.yml index 51dc144d4..326ccc8e5 100644 --- a/.github/workflows/auto-tag-on-release-pr-merge.yml +++ b/.github/workflows/auto-tag-on-release-pr-merge.yml @@ -61,3 +61,15 @@ jobs: gh workflow run release.yml \ -f version="$VERSION" \ -f ref="v$VERSION" + + - name: Trigger Docker image build + # docker.yml's on:push:tags trigger never fires for this tag because + # the tag was pushed with GITHUB_TOKEN (recursion guard). Dispatch it + # explicitly with version+ref, same as the release build above. + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + VERSION: ${{ env.version }} + run: | + gh workflow run docker.yml \ + -f version="$VERSION" \ + -f ref="v$VERSION" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 8f7c461fa..a9ff0faf7 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -12,7 +12,18 @@ name: Docker image # - push to main → :main + :sha-<7> # - push tags v*.*.* → :latest + :{version} + :{major}.{minor} + :{major} # - pull_request → build only (no push), cache stays warm -# - workflow_dispatch → manual canary +# - workflow_dispatch → manual canary, or release-tag dispatch with +# version+ref inputs (auto-tag rescues the dead +# push:tags trigger this way — see below) +# +# Why workflow_dispatch carries version/ref inputs: +# auto-tag-on-release-pr-merge.yml pushes the release tag with the default +# GITHUB_TOKEN, which GitHub deliberately does NOT let fire on:push triggers +# (recursion guard). So the push:tags trigger above never runs for releases. +# auto-tag instead dispatches this workflow with the version + tag ref, the +# same rescue release.yml already uses. On dispatch github.ref is `main`, so +# the tag ref must be plumbed through explicitly: checkout pins to inputs.ref, +# and the semver tags take inputs.version via metadata-action `value=`. on: push: @@ -33,6 +44,14 @@ on: - "pnpm-workspace.yaml" - "patches/**" workflow_dispatch: + inputs: + version: + description: "Semver version e.g. 0.3.26 (no v prefix) — for tag-release dispatch" + required: false + ref: + description: "Tag/branch/SHA to build, e.g. v0.3.26" + required: false + default: main # One image build per ref; cancel superseded PR builds, but never cancel # tag/main builds (publishing must not be aborted mid-flight). @@ -77,6 +96,9 @@ jobs: - name: Checkout uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 with: + # On workflow_dispatch (release-tag rescue) build the tagged commit, + # not main. Empty string = default ref for push/PR events. + ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }} persist-credentials: false - name: Set up Docker Buildx @@ -108,9 +130,9 @@ jobs: tags: | type=ref,event=branch type=sha,prefix=sha-,format=short - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} + type=semver,pattern={{version}},value=${{ inputs.version }} + type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }} + type=semver,pattern={{major}},value=${{ inputs.version }} type=raw,value=latest,enable={{is_default_branch}} labels: | org.opencontainers.image.title=Buzz @@ -189,9 +211,9 @@ jobs: tags: | type=ref,event=branch type=sha,prefix=sha-,format=short - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} + type=semver,pattern={{version}},value=${{ inputs.version }} + type=semver,pattern={{major}}.{{minor}},value=${{ inputs.version }} + type=semver,pattern={{major}},value=${{ inputs.version }} type=raw,value=latest,enable={{is_default_branch}} - name: Create and push manifest list