fix: stop the raw dispatch tag from moving :latest on every run - #72
Merged
Merged
Conversation
`type=raw,event=workflow_dispatch,value=...` does not do what it reads like.
`event=` is an attribute of `type=ref`; `type=raw` takes only enable, priority,
prefix, suffix and value. metadata-action ignores the attribute it does not
recognise, so the directive reduced to a plain `type=raw,value=latest` and
applied to every run — branch builds and prereleases included.
specs-cli v0.0.14-rc.2 is the visible case: the merge job's tag list came out as
0.0.14-rc.2, v0.0.14-rc.2 and latest, so :latest now points at a release
candidate. The guards meant to prevent that had all fired correctly —
`type=raw,value=latest,suffix=,enable=false` and `flavor: latest=false` — because
neither governs a second, unconditional raw tag.
Swaps `event=` for `enable=${{ github.event_name == 'workflow_dispatch' }}` in
both actions.
In build-image the tag never reached the registry, since that build pushes by
digest, but it was the only directive in the block and so became
org.opencontainers.image.version — which is why release builds were labelled
"latest". That label is now absent rather than wrong; build-image takes no
version input, so it was never derived from anything meaningful. metadata-action
will log "No Docker tag has been generated" there on tag and branch builds.
Ilyes512
force-pushed
the
fix/raw-latest-tag-on-dispatch-only
branch
from
September 22, 2026 10:19
6b488e8 to
fa2484f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
event=workflow_dispatchwithenable=${{ github.event_name == 'workflow_dispatch' }}on thetype=rawdirective increate-manifestandbuild-image.docs/pipeline.mdthatevent=belongs totype=refonly, and thatflavor: latest=falsedoes not govern an explicit raw tag.The bug
type=raw,event=workflow_dispatch,value=...does not do what it reads like.event=is an attribute oftype=ref;type=rawtakes onlyenable,priority,prefix,suffixandvalue. metadata-action ignores the unrecognised attribute rather than failing, so the directive reduced to a plaintype=raw,value=latestthat applied to every run — branch builds and prereleases included.specs-cliv0.0.14-rc.2is the visible case. The merge job's tag list came out as:So
:latestcurrently points at a release candidate, which bothdocs/pipeline.mdanddocs/go-cli.mdpromise cannot happen. The guards meant to prevent it had all fired correctly — the run showstype=raw,value=latest,suffix=,enable=falseandflavor: latest=false— because neither governs a second, unconditional raw tag.Note on build-image
There the tag never reached the registry, since that build pushes by digest. But it was the only directive in the block, so it became
org.opencontainers.image.version— which is why release builds were labelledversion=latest. That label is now absent rather than wrong;build-imagetakes noversioninput, so it was never derived from anything meaningful. metadata-action will logNo Docker tag has been generatedthere on tag and branch builds. If a correct per-arch version label is wanted, that is a follow-up:build-imagewould need aversioninput the waycreate-manifesthas one.Scope
create-manifestis shared, so the same wrong:latestbehaviour applied to every image built through this pipeline, the PHP images included.Verified with
actionlint.