ci: refuse to re-publish an existing image tag (zegit#262) #14

Merged

markus merged 1 commits from claude/ci/refuse-existing-tag into master

2026-10-19 12:32:29 +00:00

Author	SHA1	Message	Date
agentandClaude Opus 5.5	f08fce4ab6	ci: refuse to re-publish an existing image tag (zegit#262) A dispatch for 12.11.1-ci7 without sign_only rebuilt and re-pushed the tag. The registry dropped the old manifest, so flux-config's 12.11.1-ci7@sha256:86d7e3b4 pin now 404s on the next pull. That is the zegit#143 threat shape, done by accident. Like zegit-arc-runner, a build now refuses a tag the registry already holds, and sign_only refuses one it does not. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>	2026-10-19 14:25:29 +02:00

Author

SHA1

Message

Date

agentandClaude Opus 5.5

f08fce4ab6

ci: refuse to re-publish an existing image tag (zegit#262)

A dispatch for 12.11.1-ci7 without sign_only rebuilt and re-pushed the
tag. The registry dropped the old manifest, so flux-config's
12.11.1-ci7@sha256:86d7e3b4 pin now 404s on the next pull. That is the
zegit#143 threat shape, done by accident. Like zegit-arc-runner, a build
now refuses a tag the registry already holds, and sign_only refuses one
it does not.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-19 14:25:29 +02:00