fix(ci): derive publish mode from trigger to kill latest overwrite race #373

Merged

David merged 3 commits from fix/GOV-15-twin-trigger-publish-mode into main

2026-06-28 03:27:12 +02:00

David commented

2026-06-26 14:08:16 +02:00

Owner

What

Roll the GOV-13 twin-trigger publish-mode fix into this repo's build-oci-image.yml and its companion oci-build/get-tags.nu.

Why

The workflow triggered on push to both branches: [main] and tags: [v*] and resolved its tags from git describe via get-tags.nu --joined, returning [vX.Y.Z, latest] on a tagged commit. A release commit is at once a main push and a v* tag push, so both workflow events fired, both built the same image, and both raced to overwrite the mutable :latest tag (last writer wins, non-deterministic).

How

Port the trigger-derived publish-mode pattern proven in the governance templates: resolve the mode from github.event_name / github.ref_type (tag ref -> release publishes :vX.Y.Z only, main push -> latest publishes :latest only, workflow_dispatch -> dry-run that builds and prints but mutates nothing). get-tags.nu now takes --mode and returns a single disjoint tag per mode, so the two runs of a release commit publish different tags and never collide.

Verification

build-oci-image.yml parses, the rewritten get-tags.nu passes nu-check, and get-tags.nu was exercised across release / latest / dry-run (+ simulate-tag) plus both error paths (exit 1). The repo's just pre-commit suite (fmt, clippy, wasm check, 189 lib tests) passed before the commit landed.

Part of the GOV-15 rollout. Links GOV-13 (template fix) and GOV-15 (this rollout).

## What Roll the GOV-13 twin-trigger publish-mode fix into this repo's `build-oci-image.yml` and its companion `oci-build/get-tags.nu`. ## Why The workflow triggered on push to both `branches: [main]` and `tags: [v*]` and resolved its tags from `git describe` via `get-tags.nu --joined`, returning `[vX.Y.Z, latest]` on a tagged commit. A release commit is at once a main push and a `v*` tag push, so both workflow events fired, both built the same image, and both raced to overwrite the mutable `:latest` tag (last writer wins, non-deterministic). ## How Port the trigger-derived publish-mode pattern proven in the governance templates: resolve the mode from `github.event_name` / `github.ref_type` (tag ref -> `release` publishes `:vX.Y.Z` only, main push -> `latest` publishes `:latest` only, `workflow_dispatch` -> `dry-run` that builds and prints but mutates nothing). `get-tags.nu` now takes `--mode` and returns a single disjoint tag per mode, so the two runs of a release commit publish different tags and never collide. ## Verification `build-oci-image.yml` parses, the rewritten `get-tags.nu` passes `nu-check`, and `get-tags.nu` was exercised across `release` / `latest` / `dry-run` (+ simulate-tag) plus both error paths (exit 1). The repo's `just pre-commit` suite (fmt, clippy, wasm check, 189 lib tests) passed before the commit landed. Part of the GOV-15 rollout. Links GOV-13 (template fix) and GOV-15 (this rollout).

David added 1 commit

2026-06-26 14:08:16 +02:00

fix(ci): derive publish mode from trigger to kill latest overwrite race

Check / fmt + clippy + tests (pull_request) Successful in 1m13s

Details

9e5f9a5da5

The build-oci-image workflow triggered on push to both main and v* tags and resolved its tag set from git describe via get-tags.nu --joined, which returned [vX.Y.Z, latest] on a tagged commit. A release commit is simultaneously a main push and a v* tag push, so both workflow events fired, both built the same image, and both raced to overwrite the mutable :latest tag (last writer wins, non-deterministic).

Port the trigger-derived publish-mode pattern from the governance templates (GOV-13): resolve the mode from github.event_name/github.ref_type (tag -> release publishes :vX.Y.Z only, main push -> latest publishes :latest only, workflow_dispatch -> dry-run that builds and prints but mutates nothing). get-tags.nu now takes --mode and returns a single disjoint tag per mode, so the two runs of a release commit publish different tags and never collide.

#GOV-15
#GOV-13

David added 1 commit

2026-06-26 23:08:58 +02:00

Merge branch 'main' into fix/GOV-15-twin-trigger-publish-mode

Check / fmt + clippy + tests (pull_request) Successful in 1m25s

Details

b9f885fd34