ci: branch-tagged image builds via workflow_dispatch (#1994 Phase 1)

[cyberantonz]

Part of #1994 (Phase 1 — manual branch builds + image report). Companion PR in insight-front follows the same scheme.

What changes

• Branch-aware build tag: workflow_dispatch from a non-main ref tags images <YYYY.MM.DD.HH.MM>-<sha7>.<sanitized-branch> (sanitized to the docker-tag charset via tr -c 'a-zA-Z0-9._-' '-', edge separators trimmed, capped at 60 chars). Main pushes keep the exact current suffix-less format; PR runs keep building without pushing.
• One push policy: the ~22 inline github.event_name != 'pull_request' && github.ref == 'refs/heads/main' guards (login / push= / digest export+upload / merge-job conditions) are replaced by a single should_push output on the changes job — true for a main push and any workflow_dispatch, false for PRs.
• latest stays main-only: enable=${{ github.ref == 'refs/heads/main' }} on the latest tag in every merge job.
• Step-summary report: every merge job writes its pushed image:tag ref to $GITHUB_STEP_SUMMARY, so the run page shows a copy-pastable list.

What deliberately does not change

• bump-descriptors and publish-chart keep their existing ref == main gates — a branch build can never auto-commit descriptor/appVersion bumps or publish a chart. Backstop: publish-chart's appVersion regex (^[0-9]{4}(\.[0-9]{2}){4}-[0-9a-f]{7}$) rejects branch-suffixed tags outright.
• Main-push and PR behavior is byte-for-byte identical to today.
• Consuming a branch image in an environment remains a manual gitops tag override.

Usage

gh workflow run build-images.yml --repo constructorfabric/insight --ref my-branch

or Actions → Build & Push Container Images → Run workflow → pick the branch (must live in this repo, not a fork). Empty frontend_tag = full rebuild of all images, same as today's manual dispatch semantics.

Validation

• YAML parse + yamlfmt/pre-commit green; tags block scalars verified comment-free (metadata-action parses them as tag lines).
• Sanitizer exercised against release/2026-08, feat/bff+auth, unicode, leading/trailing separators, and >60-char names — all produce valid docker tags.
• End-to-end: workflow_dispatch runs the workflow definition from the dispatched ref, so dispatching this branch itself (once it lives in this repo or after merge) exercises the branch-tag path; a main dispatch reproduces today's behavior.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Standardized container image publishing rules across build pipelines.
  • Prevented image pushes and “latest” tags for pull request and non-main builds.
  • Ensured image merge and digest export steps follow the same publishing policy.

• Improvements

  • Added build summaries with copy-ready references for published images.
  • Unified build tag generation across backend services, ingestion tooling, and connectors.

[coderabbitai]

📝 Walkthrough

Walkthrough

The image workflow now computes a shared build tag and push policy, applies it to backend, toolbox, and connector image publishing and manifest merging, restricts latest tags to main, and reports pushed image references in job summaries.

Changes

Image publishing policy

Layer / File(s)	Summary
Shared build tag and push policy .github/workflows/build-images.yml	The workflow emits a centralized should_push decision and sanitized build tags for downstream jobs.
Backend image pipelines .github/workflows/build-images.yml	Analytics, authenticator, gateway, identity, and identity-resolution builds and merges use centralized push gating, main-only latest tags, and image summary reporting.
Toolbox image pipeline .github/workflows/build-images.yml	Toolbox publishing, digest handling, manifest merging, latest tagging, and summary reporting use the shared policy.
Connector image pipeline .github/workflows/build-images.yml	Connector build and merge jobs apply shared push and digest gating, main-only latest tagging, and pushed-image summary reporting.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• constructorfabric/insight#1994 — Covers the same workflow changes involving branch-suffixed tags, centralized push gating, main-only latest tags, and pushed image references.

Suggested reviewers: mitasovr, ktursunov

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main change: branch-tagged image builds for workflow_dispatch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-images.yml:
- Around line 133-137: Update the SAFE_BRANCH/B​UILD_TAG construction to retain
a deterministic, collision-resistant identifier derived from the full REF_NAME
after sanitization, including when sanitization produces an empty value or
truncation removes distinguishing characters. Preserve the readable sanitized
branch component while append­ing a sufficiently unique hash or equivalent
stable suffix, and ensure distinct Unicode refs cannot produce the same final
tag.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a030211-8355-4acd-83c9-8e5366ee5e2b

📥 Commits

Reviewing files that changed from the base of the PR and between 6a2d12a and a474b26.

📒 Files selected for processing (1)

• .github/workflows/build-images.yml