Key image tags to the last domain-touching commit, not the branch tip #3

Merged

admin_emi merged 1 commit from domain-sha-tags into dev

2026-07-23 13:42:31 +00:00

admin_emi commented

2026-07-23 13:41:30 +00:00

Owner

Fixes the phantom-image deploy failures (e.g. backend-deploy-prod on today's release tip): in a path-filtered monorepo the tip is often another domain's commit, so tip-keyed tags point at images no build produced. Build and deploy now share one key — git log -1 -- <domain>/ — with fetch-depth:0 checkouts so deploys can compute it. After promotion, build-push needs one dispatch per domain per branch to mint images under the new keys.

Fixes the phantom-image deploy failures (e.g. backend-deploy-prod on today's release tip): in a path-filtered monorepo the tip is often another domain's commit, so tip-keyed tags point at images no build produced. Build and deploy now share one key — `git log -1 -- <domain>/` — with fetch-depth:0 checkouts so deploys can compute it. After promotion, build-push needs one dispatch per domain per branch to mint images under the new keys.

admin_emi added 1 commit 2026-07-23 13:41:32 +00:00

Key image tags to the last domain-touching commit, not the branch tip

PR build (required check) / build-backend (pull_request) Has been skipped

Details

PR build (required check) / build-frontend (pull_request) Has been skipped

Details

PR build (required check) / gate (pull_request) Successful in 2s

Details

PR build (required check) / changes (pull_request) Successful in 6s

Details

secrets-guard / encrypted (pull_request) Successful in 5s

Details

PR build (required check) / validate-observability (pull_request) Has been skipped

Details

0d5bd5dcbf

In a path-filtered monorepo the branch tip is often another domain's
commit: a push tipping at an infra-only change made every backend deploy
(push-triggered or dispatched) compute sha-<tip> and go looking for an
image no build ever produced -- 5 minutes of pull retries, then a red run
(this bit backend-deploy-prod on the release tip today).

Build and deploy now compute the SAME key: git log -1 -- <domain>/, the
last commit that actually touched the domain. Builds tag with it, deploys
pull it, dispatches always resolve, and re-pushes of unrelated commits
are naturally idempotent (same key -> image already exists). Deploy
workflows gain a fetch-depth:0 checkout -- a depth-1 clone can't see past
an unrelated tip to find the key.