fix: pin OCI image to psa-systems/mokosh-api with SemVer-only tags #3

Merged

vas2000-work merged 1 commit from fix/oci-image-path-and-tags into main

2026-05-05 00:24:18 +02:00

vas2000-work commented

2026-05-05 00:23:36 +02:00

Owner

Workflow now pushes to dev.a8n.run/psa-systems/mokosh-api instead of dev.a8n.run//mokosh-server; the path matches the deployed Traefik foundation in NiceGuyIT/docker (template/mokosh-api) and the per-host stack dirs on nc-01 (prod) and hc-01 (staging) where the API is routed at msp..
Trigger narrowed to v* tag pushes only. Main branch pushes no longer fire the build because every produced image must be a deploy-ready SemVer release; main-branch validation is a separate concern that can be added back as its own workflow without --push.
get-tags.nu drops the rolling latest tag entirely. Tagged commits emit [vX.Y.Z]; any non-tag state (post-tag commits, no tags) emits an empty list, so accidental runs cannot publish unpinned images.
Adds GIT_SHA build arg passed by the workflow as github.sha and propagated to the runtime image as the standard org.opencontainers.image.revision label, so deployed images are traceable back to the exact commit.
Updates the org.opencontainers.image.source label to point at the current psa-systems/mokosh-server repo location after the org migration.

Note: Pushing to dev.a8n.run/psa-systems requires FORGEJO_PAT in this repo's secrets to grant push access to the psa-systems org.

- Workflow now pushes to dev.a8n.run/psa-systems/mokosh-api instead of dev.a8n.run/<owner>/mokosh-server; the path matches the deployed Traefik foundation in NiceGuyIT/docker (template/mokosh-api) and the per-host stack dirs on nc-01 (prod) and hc-01 (staging) where the API is routed at msp.<env>. - Trigger narrowed to v* tag pushes only. Main branch pushes no longer fire the build because every produced image must be a deploy-ready SemVer release; main-branch validation is a separate concern that can be added back as its own workflow without --push. - get-tags.nu drops the rolling latest tag entirely. Tagged commits emit [vX.Y.Z]; any non-tag state (post-tag commits, no tags) emits an empty list, so accidental runs cannot publish unpinned images. - Adds GIT_SHA build arg passed by the workflow as github.sha and propagated to the runtime image as the standard org.opencontainers.image.revision label, so deployed images are traceable back to the exact commit. - Updates the org.opencontainers.image.source label to point at the current psa-systems/mokosh-server repo location after the org migration. Note: Pushing to dev.a8n.run/psa-systems requires FORGEJO_PAT in this repo's secrets to grant push access to the psa-systems org.

vas2000-work added 1 commit

2026-05-05 00:23:36 +02:00

fix: pin OCI image to psa-systems/mokosh-api with SemVer-only tags

Create release / Create release from merged PR (pull_request) Has been cancelled

Details

f11faa0c8d

- Workflow now pushes to dev.a8n.run/psa-systems/mokosh-api instead of dev.a8n.run/<owner>/mokosh-server; the path matches the deployed Traefik foundation in NiceGuyIT/docker (template/mokosh-api) and the per-host stack dirs on nc-01 (prod) and hc-01 (staging) where the API is routed at msp.<env>.

- Trigger narrowed to v* tag pushes only. Main branch pushes no longer fire the build because every produced image must be a deploy-ready SemVer release; main-branch validation is a separate concern that can be added back as its own workflow without --push.

- get-tags.nu drops the rolling latest tag entirely. Tagged commits emit [vX.Y.Z]; any non-tag state (post-tag commits, no tags) emits an empty list, so accidental runs cannot publish unpinned images.

- Adds GIT_SHA build arg passed by the workflow as github.sha and propagated to the runtime image as the standard org.opencontainers.image.revision label, so deployed images are traceable back to the exact commit.

- Updates the org.opencontainers.image.source label to point at the current psa-systems/mokosh-server repo location after the org migration.

Note: Pushing to dev.a8n.run/psa-systems requires FORGEJO_PAT in this repo's secrets to grant push access to the psa-systems org.