ci: resolve the manual version under refs/tags

The version input reached checkout as a bare ref, so a manual run given a
branch name would have built that branch and published it as an image tag,
`latest` included. It also meant a version that happens to match a branch name
would silently resolve to the branch rather than the tag.

Resolve it under refs/tags/ instead. Plain versions from backend-release keep
working, and anything that is not a tag fails at checkout.
This commit is contained in:
Alex committed 2026-09-12 23:41:43 +01:00
1 parent 99b8508bdc
commit 12016baaf2
3 files changed
+20 -12

No files matched your search

+10 -6
View File
@@ -67,9 +67,11 @@ jobs:
with:
# Build the source the tag names, not whatever the run was started
# from: a manual run dispatched off main would otherwise publish the
# current branch under an older version's tags. Empty for a push,
# where the checked-out commit is the one being tagged `develop`.
ref: ${{ inputs.version || github.ref }}
# current branch under an older version's tags. Resolved under
# refs/tags/ so a version that is also a branch name cannot win, and a
# version with no tag fails here instead of mislabelling an image.
# Falls back to the run's own ref for the push that tags `develop`.
ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
persist-credentials: false
- name: Set up Docker Buildx
@@ -197,9 +199,11 @@ jobs:
with:
# Build the source the tag names, not whatever the run was started
# from: a manual run dispatched off main would otherwise publish the
# current branch under an older version's tags. Empty for a push,
# where the checked-out commit is the one being tagged `develop`.
ref: ${{ inputs.version || github.ref }}
# current branch under an older version's tags. Resolved under
# refs/tags/ so a version that is also a branch name cannot win, and a
# version with no tag fails here instead of mislabelling an image.
# Falls back to the run's own ref for the push that tags `develop`.
ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
persist-credentials: false
- name: Attach the standalone compose file to the release
+5 -3
View File
@@ -70,9 +70,11 @@ jobs:
with:
# Build the source the tag names, not whatever the run was started
# from: a manual run dispatched off main would otherwise publish the
# current branch under an older version's tags. Empty for a push,
# where the checked-out commit is the one being tagged `develop`.
ref: ${{ inputs.version || github.ref }}
# current branch under an older version's tags. Resolved under
# refs/tags/ so a version that is also a branch name cannot win, and a
# version with no tag fails here instead of mislabelling an image.
# Falls back to the run's own ref for the push that tags `develop`.
ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
persist-credentials: false
- name: Set up Docker Buildx
+5 -3
View File
@@ -82,9 +82,11 @@ jobs:
with:
# Build the source the tag names, not whatever the run was started
# from: a manual run dispatched off main would otherwise publish the
# current branch under an older version's tags. Empty for a push,
# where the checked-out commit is the one being tagged `develop`.
ref: ${{ inputs.version || github.ref }}
# current branch under an older version's tags. Resolved under
# refs/tags/ so a version that is also a branch name cannot win, and a
# version with no tag fails here instead of mislabelling an image.
# Falls back to the run's own ref for the push that tags `develop`.
ref: ${{ inputs.version && format('refs/tags/{0}', inputs.version) || github.ref }}
persist-credentials: false
- name: Set up Docker Buildx