image-deploy

5 Commits 1 Branch 1 Tag

3 Commits

Include renames

Author	SHA1	Message	Date
Dave Kowalski	70e1a06816	fix(image-deploy): monotonic tag guard — refuse backwards newTag writes validate / validate (pull_request) Successful in 4s Details Two concurrent release runs can race such that the older build's image-deploy step finishes after the newer build already committed its tag. Without an ordering check, last-writer-wins and the manifest silently reverts to a stale image. Add _monotonic_check: reads origin/main's current newTag for the image and exits 0 (with a loud SKIP log) if it is numerically greater than the tag we are trying to write. The guard runs before the kustomize edit and again after each rebase in the push-retry loop, so both race shapes are covered: - Clone-then-lose: second clone already sees the newer tag → initial guard fires before any commit. - Concurrent-push: both cloned the same base; one pushes first; the other rebases, then the post-rebase guard fires before the re-push. Fixes bug-313bg8bgezp3	2026-08-24 22:59:36 +00:00
Dave Kowalski	9980dafc6d	fix: skip direct push when an open PR already targets the same image:tag Before committing and pushing, query the Gitea API for open PRs in the apps repo. If any open PR modifies the same kustomization.yaml path and its diff contains the target tag, exit 0 — the PR is the intended review gate and the direct push would bypass it. Fails open on API errors so an outage does not block all deploys. Fixes bug-nxhza9j2atqk	2026-08-16 06:22:32 +00:00
Donavan Fritz	511259e830	initial: action/image-deploy @v1	2026-05-06 08:07:23 -05:00

Author

SHA1

Message

Date

Dave Kowalski

70e1a06816

fix(image-deploy): monotonic tag guard — refuse backwards newTag writes

validate / validate (pull_request) Successful in 4s

Details

Two concurrent release runs can race such that the older build's
image-deploy step finishes after the newer build already committed its
tag. Without an ordering check, last-writer-wins and the manifest
silently reverts to a stale image.

Add _monotonic_check: reads origin/main's current newTag for the image
and exits 0 (with a loud SKIP log) if it is numerically greater than the
tag we are trying to write. The guard runs before the kustomize edit and
again after each rebase in the push-retry loop, so both race shapes are
covered:
- Clone-then-lose: second clone already sees the newer tag → initial
  guard fires before any commit.
- Concurrent-push: both cloned the same base; one pushes first; the
  other rebases, then the post-rebase guard fires before the re-push.

Fixes bug-313bg8bgezp3

2026-08-24 22:59:36 +00:00

Dave Kowalski

9980dafc6d

fix: skip direct push when an open PR already targets the same image:tag

Before committing and pushing, query the Gitea API for open PRs in the
apps repo. If any open PR modifies the same kustomization.yaml path and
its diff contains the target tag, exit 0 — the PR is the intended review
gate and the direct push would bypass it.

Fails open on API errors so an outage does not block all deploys.

Fixes bug-nxhza9j2atqk

2026-08-16 06:22:32 +00:00

Donavan Fritz

511259e830

initial: action/image-deploy @v1

2026-05-06 08:07:23 -05:00