fix/oci-image-path-and-tags #5

Merged

vas2000-work merged 2 commits from fix/oci-image-path-and-tags into main

2026-05-05 00:28:30 +02:00

vas2000-work commented

2026-05-05 00:28:23 +02:00

Owner

No description provided.

vas2000-work added 2 commits

2026-05-05 00:28:23 +02:00

fix: pin OCI image to psa-systems/mokosh-www with SemVer-only tags 6bdffcab18

- Workflow now pushes to dev.a8n.run/psa-systems/mokosh-www instead of dev.a8n.run/<owner>/mokosh-client; the path matches the deployed Traefik foundation in NiceGuyIT/docker (template/mokosh-www) and the per-host stack dirs on nc-01 (prod) and hc-01 (staging).

- Trigger narrowed to v* tag pushes only. Main branch pushes no longer fire the build because every produced image must be a deploy-ready SemVer release; main-branch validation is a separate concern that can be added back as its own workflow without --push.

- get-tags.nu drops the rolling latest tag entirely. Tagged commits emit [vX.Y.Z]; any non-tag state (post-tag commits, no tags) emits an empty list, so accidental runs cannot publish unpinned images.

- Adds GIT_SHA build arg passed by the workflow as github.sha and propagated to the runtime image as the standard org.opencontainers.image.revision label, so deployed images are traceable back to the exact commit.

Note: Pushing to dev.a8n.run/psa-systems requires the psa-systems org to exist on Forgejo (private visibility) and FORGEJO_PAT in this repo's secrets to grant push access to that org.

fix: update OCI source label to psa-systems org

Create release / Create release from merged PR (pull_request) Has been cancelled

Details

1bc5199096

The org.opencontainers.image.source label still pointed at a8n-tools/mokosh-clients from before the repo migrated under psa-systems. Updates the label so the published image's source URL resolves directly to the actual repo location.