From e1a6ba643336fcf3984a1bdf993145503f8a2f13 Mon Sep 17 00:00:00 2001 From: Anton Zelenov Date: Wed, 29 Jul 2026 11:19:46 +0800 Subject: [PATCH] ci: branch-tagged image builds via workflow_dispatch (insight#1994 Phase 1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A workflow_dispatch from any branch now pushes the frontend image tagged -. (branch name sanitized to the docker-tag charset, capped at 60 chars). Main keeps the suffix-less tag format. Previously a branch dispatch pushed only untagged digests — wasted work. `latest` stays default-branch-only and dispatch-umbrella keeps its main-only gate, so a branch build never moves `latest` nor pins the umbrella subchart appVersion. The merge job now also writes the pushed ref to the run's step summary for copy-paste. Co-Authored-By: Claude Fable 5 Signed-off-by: Anton Zelenov --- .github/workflows/docker.yml | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 933847e2..3ba2d5e8 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -29,8 +29,25 @@ jobs: # Format mirrors constructorfabric/insight's build-images.yml # exactly so that `sort -V` over mixed subchart appVersions on # the umbrella side stays consistent. + # + # Branch builds (insight#1994) append `.` after the + # sha so a branch image can never be mistaken for a main release tag — + # main keeps the suffix-less format, and dispatch-umbrella (which pins + # the subchart appVersion) stays main-only. + env: + REF_NAME: ${{ github.ref_name }} run: | BUILD_TAG="$(date -u +%Y.%m.%d.%H.%M)-$(echo "${GITHUB_SHA}" | cut -c1-7)" + if [ "${GITHUB_REF}" != "refs/heads/main" ]; then + # Docker tag charset is [A-Za-z0-9._-] (branch names carry `/`); + # cap the suffix well under the 128-char tag limit and trim + # separator runs the sanitizer may produce at the edges. + SAFE_BRANCH="$(printf '%s' "$REF_NAME" \ + | tr -c 'a-zA-Z0-9._-' '-' \ + | sed -E 's/^[-.]+//; s/[-.]+$//' \ + | cut -c1-60)" + BUILD_TAG="${BUILD_TAG}.${SAFE_BRANCH}" + fi echo "build_tag=${BUILD_TAG}" >> "$GITHUB_OUTPUT" echo "Build tag for this run: ${BUILD_TAG}" @@ -139,12 +156,15 @@ jobs: uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - # Two tags on default-branch pushes — matches - # constructorfabric/insight backend scheme. The date-based tag - # already embeds the sha, so a separate short-sha tag is - # redundant. + # Matches constructorfabric/insight's backend scheme. The date-based + # tag already embeds the sha, so a separate short-sha tag is + # redundant. The build tag applies on every run — the only triggers + # are a main push and workflow_dispatch, and a branch dispatch is a + # deliberate branch image build (insight#1994; the branch-suffixed + # tag comes from `prepare`). `latest` stays default-branch-only — + # a branch build must never move it. tags: | - type=raw,value=${{ needs.prepare.outputs.build_tag }},enable={{is_default_branch}} + type=raw,value=${{ needs.prepare.outputs.build_tag }} type=raw,value=latest,enable={{is_default_branch}} - name: Create multi-arch manifest and push @@ -154,6 +174,11 @@ jobs: $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *) + # Copy-pastable pushed ref on the run's Summary page (insight#1994). + - name: Report pushed image + run: | + echo '- `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.prepare.outputs.build_tag }}`' >> "$GITHUB_STEP_SUMMARY" + # ─── Umbrella chart dispatch ─────────────────────────────────────────────── # After a successful main-branch image build, trigger the umbrella chart # workflow in constructorfabric/insight so it bumps the frontend subchart