[RFC][PATCH 2/4] ci: only tag container with newest tag with latest-release

[Felix Moessbauer]

When rebuilding existing git tags, we must only tag the container with
the "biggest" version with "latest-release". This is especially
important once we add bugfix versions, as these would overwrite the tag
otherwise.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
.github/workflows/release.yml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ac3e0a3e6..736587d14 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,8 @@ jobs:
deploy-user: ${{ github.actor }}
deploy-token: ${{ secrets.GITHUB_TOKEN }}
image-name: ${{ matrix.image-name }}
+ - name: Find latest tag
+ run: echo "LATEST_TAG=$(git tag | sort --version-sort | tail -n1)" >> $GITHUB_ENV
- name: Build ${{ matrix.image-name }} image
uses: docker/build-push-action@v6
id: push
@@ -42,7 +44,7 @@ jobs:
outputs: type=registry,rewrite-timestamp=true
tags: |
ghcr.io/${{ github.repository }}/${{ matrix.image-name }}:${{ env.RELEASE_VERSION }}
- ghcr.io/${{ github.repository }}/${{ matrix.image-name }}:latest-release
+ ${{ github.ref_name == env.LATEST_TAG && format('ghcr.io/{0}/{1}:latest-release', github.repository, matrix.image-name) || '' }}
annotations: ${{ env.DOCKER_METADATA_OUTPUT_ANNOTATIONS }}
- name: Attest ${{ matrix.image-name }} image
uses: actions/attest-build-provenance@v1
--
2.51.0

[Jan Kiszka]

Patch 1 and 2 look sufficiently generic to be applied already, I guess.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[MOESSBAUER, Felix]

Right, these are independent fixes (found while testing this series).

Felix

>
> Jan
>
> --
> Siemens AG, Foundational Technologies
> Linux Expert Center

--
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

[Jan Kiszka]

On 17.09.25 14:48, 'Felix Moessbauer' via kas-devel wrote:

I suppose you meant (A && B) || ''? We should make that explicit.

Jan

> annotations: ${{ env.DOCKER_METADATA_OUTPUT_ANNOTATIONS }}
> - name: Attest ${{ matrix.image-name }} image
> uses: actions/attest-build-provenance@v1


--

[MOESSBAUER, Felix]

Actually no, this means:

if github.ref_name == env.LATEST_TAG:
format('ghcr.io/.../latest-release')
else:
''

This is expressed in horrible GitHub string expressions.
I'm also open for better ideas to achieve the same.

Felix

>
> Jan
>
> > annotations: ${{ env.DOCKER_METADATA_OUTPUT_ANNOTATIONS }}
> > - name: Attest ${{ matrix.image-name }} image
> > uses: actions/attest-build-provenance@v1
>
>
> --
> Siemens AG, Foundational Technologies
> Linux Expert Center

[Jan Kiszka]

Would brackets invalidate the syntax?

Jan

[Jan Kiszka]

On 19.09.25 12:38, Moessbauer, Felix (FT RPD CED OES-DE) wrote:

Read it up now A && B || C is indeed A ? B : C, ie. ternary operator.
Whoever designed that should be punished.

Jan

[MOESSBAUER, Felix]

Yes. We could also write the final value to an GITHUB_ENV variable and
just use that. That's probably better maintainable.
Just let me know.

> Whoever designed that should be punished.

Indeed.

Felix

>
> Jan
>
> --
> Siemens AG, Foundational Technologies
> Linux Expert Center

[Jan Kiszka]

Thanks, I've merged this patch as is for now.

Jan