feat(base-images): immutable per-publish image tags - #4607
Conversation
Mutable tags move on every republish, leaving previously published digests untagged and exposed to any future untagged-manifest cleanup, while shipped CLI releases pin those digests. A dated tag per publish keeps every digest tag-referenced permanently and doubles as a durable record of what was published when.
Two same-day publishes share a snapshot timestamp, so a date-only tag would be overwritten and orphan the first publish's digests; snapshot date plus commit matches exactly what determines the digests, and a re-run of the same commit re-tags the identical digest.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📜 Recent review details⏰ Context from checks skipped due to timeout. (8)
WalkthroughThe setup job generates a publish ID from the Debian snapshot date and short commit SHA. The workflow exports this ID and adds immutable snapshot-specific tags to runtime and build images while retaining mutable tags. The README documents the tag format, retention requirement, and use by digest-pinned CLI releases. Mergeability Score: ⚪ Minimal · up to The change adds immutable per-publish image tags to preserve digest references, and no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
The snapshot timestamp, not just its date, determines the published digests; a same-commit dispatch with an intra-day snapshot time could otherwise overwrite the tag and orphan the earlier digests.
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
2 participants
Every publish now also pushes an immutable per-publish tag alongside the mutable one, named after the snapshot date and commit (e.g.
22-bookworm-20260812-45444a7), so previously published digests stay tag-referenced after republishes. Shipped CLI releases pin those digests, so they must remain resolvable indefinitely.Merging triggers a republish; the fresh tag-protected digests will then be pinned by #4602 before it merges.