From 99b8508bdc06248e51967904934f30d47d83eb09 Mon Sep 17 00:00:00 2001
From: Alex <a@tushynski.me>
Date: Sat, 12 Sep 2026 23:37:14 +0100
Subject: [PATCH] ci: build the source the version names

A manual run takes the version as an input but the checkout had no ref, so it
built whatever the run was dispatched from. Dispatching off main to rebuild an
older release would have published current main under that release's tags, and
moved `latest` to it.

Check out the version instead, falling back to the run's own ref when there is
no version, which is the push that publishes `develop`. The release and call
paths already checked out the right commit; this makes them explicit and fails
loudly on a version with no tag rather than mislabelling an image. The compose
file attached to the release now comes from the tag too.
---
 .github/workflows/ci.yml            | 10 ++++++++++
 .github/workflows/cife.yml          |  5 +++++
 .github/workflows/sandbox-image.yml |  5 +++++
 3 files changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af3d1137..d115eec6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,6 +65,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -190,6 +195,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Attach the standalone compose file to the release
diff --git a/.github/workflows/cife.yml b/.github/workflows/cife.yml
index 11ddaa9f..cf9d1241 100644
--- a/.github/workflows/cife.yml
+++ b/.github/workflows/cife.yml
@@ -68,6 +68,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/sandbox-image.yml b/.github/workflows/sandbox-image.yml
index 96303100..61e28542 100644
--- a/.github/workflows/sandbox-image.yml
+++ b/.github/workflows/sandbox-image.yml
@@ -80,6 +80,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx