Make versioned tags immutable
Some checks failed
Check for Flutter SDK, Android SDK, and Base Image Updates / check-update (push) Failing after 10s

- Full release (3.38.9): creates web-3.38.9 + web-latest
- Prerelease (3.38.9-rebuild-20260203): creates web-3.38.9-rebuild-20260203 + web-dev
- Versioned tags never get overwritten after initial publish

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Mathias Beaulieu-Duncan 2026-02-03 04:25:21 -05:00
parent 3aa55f7590
commit 33ad166ce8

View File

@ -33,16 +33,18 @@ jobs:
id: version id: version
run: | run: |
if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
# Pre-release: fetch latest stable version, tag as dev # Pre-release: use release tag as version, don't overwrite existing tags
FLUTTER_VERSION=$(curl -fsSL https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json \ # Extract base Flutter version for build-arg (e.g., 3.38.9 from 3.38.9-rebuild-20260203)
| jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version') BASE_VERSION=$(echo "${{ github.event.release.tag_name }}" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
echo "flutter_version=${FLUTTER_VERSION}" >> $GITHUB_OUTPUT echo "flutter_version=${BASE_VERSION}" >> $GITHUB_OUTPUT
echo "tag=${{ matrix.variant }}-dev" >> $GITHUB_OUTPUT echo "tag=${{ matrix.variant }}-${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
echo "Using latest Flutter stable ${FLUTTER_VERSION} for pre-release test" echo "secondary_tag=${{ matrix.variant }}-dev" >> $GITHUB_OUTPUT
echo "Pre-release: building Flutter ${BASE_VERSION}, tagging as ${{ github.event.release.tag_name }}"
else else
# Full release: use the release tag as the Flutter version # Full release: use the release tag as the Flutter version
echo "flutter_version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT echo "flutter_version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
echo "tag=${{ matrix.variant }}-latest" >> $GITHUB_OUTPUT echo "tag=${{ matrix.variant }}-${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
echo "secondary_tag=${{ matrix.variant }}-latest" >> $GITHUB_OUTPUT
fi fi
- name: Set up QEMU - name: Set up QEMU
@ -67,7 +69,7 @@ jobs:
load: true load: true
build-args: | build-args: |
FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }} FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }}
tags: ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }} tags: ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
- name: Install Docker Scout - name: Install Docker Scout
run: | run: |
@ -76,7 +78,7 @@ jobs:
- name: Docker Scout CVE Scan - name: Docker Scout CVE Scan
run: | run: |
docker scout cves ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }} --only-severity critical,high docker scout cves ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }} --only-severity critical,high
- name: Build and push with attestations - name: Build and push with attestations
uses: docker/build-push-action@v5 uses: docker/build-push-action@v5
@ -90,12 +92,12 @@ jobs:
build-args: | build-args: |
FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }} FLUTTER_VERSION=${{ steps.version.outputs.flutter_version }}
tags: | tags: |
${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }}
${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }} ${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}
${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.secondary_tag }}
labels: | labels: |
org.opencontainers.image.title=${{ env.IMAGE_NAME }} org.opencontainers.image.title=${{ env.IMAGE_NAME }}
org.opencontainers.image.description=${{ matrix.description }} org.opencontainers.image.description=${{ matrix.description }}
org.opencontainers.image.version=${{ matrix.variant }}-${{ steps.version.outputs.flutter_version }} org.opencontainers.image.version=${{ steps.version.outputs.tag }}
org.opencontainers.image.revision=${{ github.sha }} org.opencontainers.image.revision=${{ github.sha }}
sync-readme: sync-readme: