A pull request must not touch :latest #12

Merged

austin merged 1 commits from ci/pr-image-tag into main

2026-07-27 09:58:25 -05:00

Author	SHA1	Message	Date
austinandClaude Opus 5	4f4082ecd7	A pull request must not touch :latest build-and-publish / build (pull_request) Successful in 2m0s Details This runner builds on the host's Docker daemon — the same daemon the live container runs on — so retagging :latest IS a deployment. Watchtower compares the running container's image against :latest, sees they differ, and recreates the container from whatever was just built locally. Gating only the push was never enough; the build itself was the deploy. The worse failure is quieter. Reassigning :latest leaves the running container's old image untagged, and once that image is pruned Watchtower can no longer read it to compare against: Failed to retrieve container image info: No such image: sha256:… Unable to update container: no available image info. bennett-portfolio hit exactly that. It sat on a four-day-old build, failing to update 720 times in twenty-four hours, reporting healthy the whole time, and had to be recreated by hand. This repo has the same workflow and the same exposure — it simply has not been unlucky yet. A PR now builds pr-<number>, which nothing watches. Trivy scans whatever was built either way, so a bad Dockerfile or a new CVE still blocks the merge, and the push step is unchanged — still main-only. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-07-27 09:53:24 -05:00

Author

SHA1

Message

Date

austinandClaude Opus 5

4f4082ecd7

A pull request must not touch :latest

build-and-publish / build (pull_request) Successful in 2m0s

Details

This runner builds on the host's Docker daemon — the same daemon the live
container runs on — so retagging :latest IS a deployment. Watchtower compares
the running container's image against :latest, sees they differ, and recreates
the container from whatever was just built locally. Gating only the push was
never enough; the build itself was the deploy.

The worse failure is quieter. Reassigning :latest leaves the running
container's old image untagged, and once that image is pruned Watchtower can no
longer read it to compare against:

  Failed to retrieve container image info: No such image: sha256:…
  Unable to update container: no available image info.

bennett-portfolio hit exactly that. It sat on a four-day-old build, failing to
update 720 times in twenty-four hours, reporting healthy the whole time, and had
to be recreated by hand. This repo has the same workflow and the same exposure —
it simply has not been unlucky yet.

A PR now builds pr-<number>, which nothing watches. Trivy scans whatever was
built either way, so a bad Dockerfile or a new CVE still blocks the merge, and
the push step is unchanged — still main-only.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

2026-07-27 09:53:24 -05:00