From f345ca55b3ff39d441f6351817d238aa13842b1d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=ABl?= Date: Wed, 29 Jul 2026 00:39:16 +0200 Subject: [PATCH] ci: publish :latest instead of :stable for stable tags --- .github/workflows/build-healthchat.yaml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-healthchat.yaml b/.github/workflows/build-healthchat.yaml index b754ebf0dd..6a63c845ce 100644 --- a/.github/workflows/build-healthchat.yaml +++ b/.github/workflows/build-healthchat.yaml @@ -62,7 +62,17 @@ jobs: exit 1 fi echo "version=$VERSION" >> "$GITHUB_OUTPUT" - echo "Resolved version: $VERSION" + # `:latest` is what the ansible inventory deploys from, so only a clean + # X.Y.Z tag push may move it — never an -rc/-hotfix/-dryrun tag, and never + # a manual re-run. Otherwise a release candidate or a pipeline test would + # become production on the next deploy of any kind. + if [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ && "$GITHUB_EVENT_NAME" == "push" ]]; then + IS_STABLE=true + else + IS_STABLE=false + fi + echo "is_stable=$IS_STABLE" >> "$GITHUB_OUTPUT" + echo "Resolved version: $VERSION (moves :latest: $IS_STABLE)" - name: Resolve workspace ref id: workspace @@ -157,7 +167,7 @@ jobs: images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE }} tags: | type=raw,value=${{ steps.version.outputs.version }} - type=raw,value=stable + type=raw,value=latest,enable=${{ steps.version.outputs.is_stable == 'true' }} type=raw,value=${{ github.sha }} - name: Set up Docker Buildx