From 12016baaf2bb1c3ce0204159ce877c896d8369b7 Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Sat, 12 Sep 2026 23:41:43 +0100
Subject: [PATCH] ci: resolve the manual version under refs/tags

The version input reached checkout as a bare ref, so a manual run given a
branch name would have built that branch and published it as an image tag,
`latest` included. It also meant a version that happens to match a branch name
would silently resolve to the branch rather than the tag.

Resolve it under refs/tags/ instead. Plain versions from backend-release keep
working, and anything that is not a tag fails at checkout.
---
 .github/workflows/ci.yml            | 16 ++++++++++------
 .github/workflows/cife.yml          |  8 +++++---
 .github/workflows/sandbox-image.yml |  8 +++++---
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d115eec6..5cd9c85e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -67,9 +67,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -197,9 +199,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Attach the standalone compose file to the release
diff --git a/.github/workflows/cife.yml b/.github/workflows/cife.yml
index cf9d1241..5f801b24 100644
--- a/.github/workflows/cife.yml
+++ b/.github/workflows/cife.yml
@@ -70,9 +70,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/sandbox-image.yml b/.github/workflows/sandbox-image.yml
index 61e28542..c020187a 100644
--- a/.github/workflows/sandbox-image.yml
+++ b/.github/workflows/sandbox-image.yml
@@ -82,9 +82,11 @@ jobs:
         with:
           # Build the source the tag names, not whatever the run was started
           # from: a manual run dispatched off main would otherwise publish the
-          # current branch under an older version's tags. Empty for a push,
-          # where the checked-out commit is the one being tagged `develop`.
-          ref: ${{ inputs.version || github.ref }}
+          # current branch under an older version's tags. Resolved under
+          # refs/tags/ so a version that is also a branch name cannot win, and a
+          # version with no tag fails here instead of mislabelling an image.
+          # Falls back to the run's own ref for the push that tags `develop`.
+          ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx