ci(publish): push a commit-sha tag on supervisor builds from main

Matches the webapp publish, which already pushes an immutable full-sha tag next to the mutable main tag so a build can be pinned by commit.

Author: nicktrn

.github/workflows/publish-worker-v4.yml

@@ -92,6 +92,12 @@ jobs:
             image_tags=$image_tags,$ref_without_tag:v4,$ref_without_tag:latest
           fi
 
+          # when pushing the mutable main tag, also push an immutable-by-convention
+          # full-commit-sha tag so a commit can be resolved to a specific digest
+          if [[ "${STEPS_GET_TAG_OUTPUTS_TAG}" == "main" ]]; then
+            image_tags=$image_tags,$ref_without_tag:${GITHUB_SHA}
+          fi
+
           echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
           echo "image_repo=${ref_without_tag}" >> "$GITHUB_OUTPUT"
         env: