From fa2484fc687a49217a33067b1662dffe618985eb Mon Sep 17 00:00:00 2001 From: Ilyes512 Date: Sat, 19 Sep 2026 15:43:52 +0200 Subject: [PATCH 1/2] fix: stop the raw dispatch tag from moving :latest on every run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `type=raw,event=workflow_dispatch,value=...` does not do what it reads like. `event=` is an attribute of `type=ref`; `type=raw` takes only enable, priority, prefix, suffix and value. metadata-action ignores the attribute it does not recognise, so the directive reduced to a plain `type=raw,value=latest` and applied to every run — branch builds and prereleases included. specs-cli v0.0.14-rc.2 is the visible case: the merge job's tag list came out as 0.0.14-rc.2, v0.0.14-rc.2 and latest, so :latest now points at a release candidate. The guards meant to prevent that had all fired correctly — `type=raw,value=latest,suffix=,enable=false` and `flavor: latest=false` — because neither governs a second, unconditional raw tag. Swaps `event=` for `enable=${{ github.event_name == 'workflow_dispatch' }}` in both actions. In build-image the tag never reached the registry, since that build pushes by digest, but it was the only directive in the block and so became org.opencontainers.image.version — which is why release builds were labelled "latest". That label is now absent rather than wrong; build-image takes no version input, so it was never derived from anything meaningful. metadata-action will log "No Docker tag has been generated" there on tag and branch builds. --- build-image/action.yml | 2 +- create-manifest/action.yml | 2 +- docs/pipeline.md | 30 +++++++++++++++++++++++------- 3 files changed, 25 insertions(+), 9 deletions(-) diff --git a/build-image/action.yml b/build-image/action.yml index 6037616..9560818 100644 --- a/build-image/action.yml +++ b/build-image/action.yml @@ -108,7 +108,7 @@ runs: with: images: ${{ inputs.image-name }} tags: | - type=raw,event=workflow_dispatch,value=${{ steps.raw_tag.outputs.lowercase }} + type=raw,value=${{ steps.raw_tag.outputs.lowercase }},enable=${{ github.event_name == 'workflow_dispatch' }} labels: | ${{ inputs.title != '' && format('org.opencontainers.image.title={0}', inputs.title) || '' }} ${{ inputs.description != '' && format('org.opencontainers.image.description={0}', inputs.description) || '' }} diff --git a/create-manifest/action.yml b/create-manifest/action.yml index c09159f..d3244be 100644 --- a/create-manifest/action.yml +++ b/create-manifest/action.yml @@ -69,7 +69,7 @@ runs: type=ref,event=branch type=ref,event=tag type=ref,event=pr - type=raw,event=workflow_dispatch,value=${{ steps.raw_tag.outputs.lowercase }} + type=raw,value=${{ steps.raw_tag.outputs.lowercase }},enable=${{ github.event_name == 'workflow_dispatch' }} ${{ inputs.raw-tags }} flavor: ${{ inputs.flavor }} labels: | diff --git a/docs/pipeline.md b/docs/pipeline.md index d4683f5..592eea6 100644 --- a/docs/pipeline.md +++ b/docs/pipeline.md @@ -32,13 +32,25 @@ Artifacts are kept for one day. They are an implementation detail of a single ru Tagging happens entirely in phase 2, from `metadata-action`. `create-manifest` always emits: -| Directive | Produces | -|------------------------------------|------------------------------------------------------| -| `type=schedule` | `nightly` on a scheduled run | -| `type=ref,event=branch` | The branch name, i.e. `main` | -| `type=ref,event=tag` | The tag name verbatim, i.e. `v1.2.3` or `2.2.0` | -| `type=ref,event=pr` | `pr-` | -| `type=raw,event=workflow_dispatch` | The `raw-tag` input, lowercased, `latest` by default | +| Directive | Produces | +|---------------------------|------------------------------------------------------| +| `type=schedule` | `nightly` on a scheduled run | +| `type=ref,event=branch` | The branch name, i.e. `main` | +| `type=ref,event=tag` | The tag name verbatim, i.e. `v1.2.3` or `2.2.0` | +| `type=ref,event=pr` | `pr-` | +| `type=raw`, on dispatch | The `raw-tag` input, lowercased, `latest` by default | + +That last one is filtered with `enable=${{ github.event_name == 'workflow_dispatch' }}`, not +`event=workflow_dispatch`. `event=` belongs to `type=ref`; `type=raw` takes only `enable`, `priority`, `prefix`, +`suffix` and `value`. An `event=` written on a `type=raw` directive does not fail — metadata-action ignores the +attribute it does not know, and the tag silently becomes unconditional. That is worth remembering when editing +either tags block: the mistake has no symptom until a tag lands somewhere it should not. + +`build-image` carries the same directive, where it has no effect on the registry — that build pushes by digest, so +its computed tags are never applied. It is the only directive in that block, so what it does decide is +`org.opencontainers.image.version` on the per-architecture images. Filtered to dispatch runs, tag and branch builds +now leave that label unset and `metadata-action` logs `No Docker tag has been generated`. `build-image` takes no +`version` input, so there is nothing truer to put there; the manifest gets its own version from `create-manifest`. Two inputs extend that: @@ -52,6 +64,10 @@ Two inputs extend that: `flavor: latest=false` and add your own guarded `latest` tag through `raw-tags`, which is what [`merge-go-cli.yml`](go-cli.md) does. +Note that `flavor: latest=false` only governs the implicit `:latest` that `type=ref` and `type=semver` bring with +them. It has no effect on an explicit `type=raw,value=latest`, which is why the dispatch directive above needs a +filter of its own rather than relying on the flavor. + ## Labels and annotations `title`, `description` and `version` override the corresponding `org.opencontainers.image.*` values. Anything left From e7570459ba19b675892c4dd6451b3e724ba353bf Mon Sep 17 00:00:00 2001 From: Ilyes512 Date: Tue, 22 Sep 2026 12:22:34 +0200 Subject: [PATCH 2/2] Bump internal version reference to 2.4.3 --- .github/workflows/build.yml | 2 +- .github/workflows/merge.yml | 2 +- README.md | 2 +- docs/actions.md | 4 ++-- docs/go-cli.md | 8 ++++---- docs/php.md | 4 ++-- docs/testing-images.md | 2 +- 7 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index dfb925a..7b9ea6b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -85,7 +85,7 @@ jobs: uses: docker/setup-buildx-action@v4 - name: Build and Push by digest - uses: specsnl/github-actions/build-image@2.4.2 + uses: specsnl/github-actions/build-image@2.4.3 with: dockerfile: ${{ inputs.dockerfile }} context: ${{ inputs.context }} diff --git a/.github/workflows/merge.yml b/.github/workflows/merge.yml index 2331c53..567ca6d 100644 --- a/.github/workflows/merge.yml +++ b/.github/workflows/merge.yml @@ -67,7 +67,7 @@ jobs: uses: docker/setup-buildx-action@v4 - name: Create Manifest - uses: specsnl/github-actions/create-manifest@2.4.2 + uses: specsnl/github-actions/create-manifest@2.4.3 with: image-name: ${{ steps.image_name.outputs.lowercase }} target: ${{ inputs.target }} diff --git a/README.md b/README.md index f11869a..3e2d134 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ This repository contains the Specsnl organisation collection of GitHub Actions workflows and composite actions that can be reused to automate various tasks in GitHub repositories. -Consumers pin by tag, i.e. `specsnl/github-actions/.github/workflows/build.yml@2.4.2`. +Consumers pin by tag, i.e. `specsnl/github-actions/.github/workflows/build.yml@2.4.3`. ## What is in here diff --git a/docs/actions.md b/docs/actions.md index 1d25567..c281ce4 100644 --- a/docs/actions.md +++ b/docs/actions.md @@ -9,7 +9,7 @@ Both assume the job has already checked out, logged in to the registry and set u ## `build-image` ```yaml -- uses: specsnl/github-actions/build-image@2.4.2 +- uses: specsnl/github-actions/build-image@2.4.3 ``` | Input | Default | Description | @@ -42,7 +42,7 @@ about conflicting outputs. With `load` on, the digest export and artifact upload ## `create-manifest` ```yaml -- uses: specsnl/github-actions/create-manifest@2.4.2 +- uses: specsnl/github-actions/create-manifest@2.4.3 ``` | Input | Default | Description | diff --git a/docs/go-cli.md b/docs/go-cli.md index 839dab9..7722482 100644 --- a/docs/go-cli.md +++ b/docs/go-cli.md @@ -21,7 +21,7 @@ permissions: jobs: build: - uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.2 + uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.3 strategy: fail-fast: false matrix: @@ -39,7 +39,7 @@ jobs: merge: needs: build - uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.2 + uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.3 with: runs-on: ubuntu-24.04 image-name: ghcr.io/specsnl/specs-cli @@ -123,7 +123,7 @@ Run the build and merge jobs once per variant, each with its own `target`: ```yaml build-alpine: - uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.2 + uses: specsnl/github-actions/.github/workflows/build-go-cli.yml@2.4.3 strategy: fail-fast: false matrix: @@ -141,7 +141,7 @@ Run the build and merge jobs once per variant, each with its own `target`: merge-alpine: needs: build-alpine - uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.2 + uses: specsnl/github-actions/.github/workflows/merge-go-cli.yml@2.4.3 with: runs-on: ubuntu-24.04 image-name: ghcr.io/specsnl/specs-cli diff --git a/docs/php.md b/docs/php.md index b9b687d..9c23cd5 100644 --- a/docs/php.md +++ b/docs/php.md @@ -8,7 +8,7 @@ what name. jobs: build: - uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.2 + uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.3 strategy: fail-fast: false matrix: @@ -24,7 +24,7 @@ jobs: merge: needs: build - uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.2 + uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.3 with: runs-on: ubuntu-24.04 image-name: ghcr.io/${{ github.repository }} diff --git a/docs/testing-images.md b/docs/testing-images.md index a82f858..ced6967 100644 --- a/docs/testing-images.md +++ b/docs/testing-images.md @@ -21,7 +21,7 @@ jobs: - uses: docker/setup-buildx-action@v4 - id: build - uses: specsnl/github-actions/build-image@2.4.2 + uses: specsnl/github-actions/build-image@2.4.3 with: platform: linux/amd64 image-name: ghcr.io/specsnl/specs-cli