Merge pull request 'tweak: tag strategy (stable + -latest) and sequential job deps on main' (#13 ) from tweak/tag-strategy-and-job-deps into master

Reviewed-on: #13
feat(main): sequential job deps — test → build-push → tag (mandatory)
2026-06-13 14:13:57 -04:00 · 2026-06-13 14:12:37 -04:00 · 2026-06-13 14:12:34 -04:00 · 2026-06-13 14:12:31 -04:00 · 2026-06-13 14:04:16 -04:00 · 2026-06-13 14:02:48 -04:00
3 changed files with 16 additions and 13 deletions
@@ -32,11 +32,11 @@ jobs:
          images: jcabillot/offlineimap
          tags: |
            type=raw,value=latest
-            type=raw,value=${{ steps.get-latest-tag.outputs.tag }},enable=${{ steps.get-latest-tag.outputs.tag != '' }}
+            type=raw,value=${{ steps.get-latest-tag.outputs.tag }}-latest,enable=${{ steps.get-latest-tag.outputs.tag != '' }}
      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          pull: true
+          pull: true
@@ -11,7 +11,15 @@ jobs:
        continue-on-error: true
        with:
          dockerfile: Dockerfile
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      - run: docker build -t ci-image:${{ github.sha }} .
+      - run: bash tests/test.sh ci-image:${{ github.sha }}
  build-push:
+    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -33,14 +41,8 @@ jobs:
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          pull: true
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
-      - run: docker build -t ci-image:${{ github.sha }} .
-      - run: bash tests/test.sh ci-image:${{ github.sha }}
  tag:
+    needs: [build-push]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -48,11 +50,11 @@ jobs:
          fetch-depth: 0
      - name: Configure git auth
        run: |
-          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@scm.cabillot.eu/perso/offlineimap.git"
+          git remote set-url origin "https://x-access-token:${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}@scm.cabillot.eu/perso/offlineimap.git"
      - uses: anothrNick/github-tag-action@4ed44965e0db8dab2b466a16da04aec3cc312fd8 # v1.75.0
        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.SA_TOKEN_ACTION_PUSH_TAGS }}
          DEFAULT_BUMP: patch
          RELEASE_BRANCHES: master
          WITH_V: true
-          GIT_API_TAGGING: false
+          GIT_API_TAGGING: false
@@ -26,10 +26,11 @@ jobs:
          images: jcabillot/offlineimap
          tags: |
            type=ref,event=tag
+            type=ref,event=tag,suffix=-latest
      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
-          pull: true
+          pull: true
Author	SHA1	Message	Date
jcabillot	2e9cb26503	Merge pull request 'tweak: tag strategy (stable + -latest) and sequential job deps on main' (#13 ) from tweak/tag-strategy-and-job-deps into master Main Release / hadolint (push) Successful in 6s Details Main Release / test (push) Successful in 12s Details Main Release / build-push (push) Successful in 36s Details Main Release / tag (push) Successful in 10s Details Tag Release / hadolint (push) Successful in 6s Details Tag Release / build-push (push) Successful in 36s Details Reviewed-on: #13	2026-06-13 14:13:57 -04:00
cloudix_mcp_server	0cf0060855	feat(main): sequential job deps — test → build-push → tag (mandatory) PR Checks / hadolint (pull_request) Successful in 6s Details PR Checks / build-test (pull_request) Successful in 12s Details	2026-06-13 14:12:37 -04:00
cloudix_mcp_server	58db03ad49	feat(cron): rebuild :vx.y.z-latest instead of :vx.y.z (stable stays at tag time)	2026-06-13 14:12:34 -04:00
cloudix_mcp_server	6acb8f0302	feat(tag): push both :vx.y.z and :vx.y.z-latest on tag event	2026-06-13 14:12:31 -04:00
jcabillot	a907089ed5	Merge pull request 'fix: correct anothrNick/github-tag-action checksum (d0→da)' (#12 ) from fix/github-tag-action-checksum into master Main Release / hadolint (push) Successful in 7s Details Main Release / tag (push) Successful in 9s Details Main Release / test (push) Successful in 13s Details Tag Release / hadolint (push) Successful in 8s Details Main Release / build-push (push) Successful in 38s Details Tag Release / build-push (push) Successful in 42s Details Reviewed-on: #12	2026-06-13 14:04:16 -04:00
cloudix_mcp_server	65f8e4b5f0	fix: correct anothrNick/github-tag-action SHA (d0→da, corrupted since PR #8 ) PR Checks / hadolint (pull_request) Successful in 6s Details PR Checks / build-test (pull_request) Successful in 11s Details Verified with git ls-remote: Tag 1.75.0 → 4ed44965e0db8dab2b466a16da04aec3cc312fd8 File had: 4ed44965e0db8dab2b466a16d04aec3cc312fd8 (wrong)	2026-06-13 14:02:48 -04:00
jcabillot	085b290a13	Merge pull request 'fix: correct docker/setup-buildx-action SHA (tag v4, 40 chars)' (#11 ) from fix/setup-buildx-checksum-v2 into master Main Release / tag (push) Failing after 2s Details Main Release / hadolint (push) Successful in 6s Details Main Release / test (push) Successful in 15s Details Main Release / build-push (push) Successful in 40s Details Reviewed-on: #11	2026-06-13 14:00:13 -04:00
cloudix_mcp_server	cc637ef241	fix: correct setup-buildx-action SHA (tag v4 is 40 chars, file had 42/45) PR Checks / hadolint (pull_request) Successful in 6s Details PR Checks / build-test (pull_request) Successful in 20s Details The SHA was corrupted since the original pipeline creation (PR #8). Verified with `git ls-remote` that the correct SHA is: d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5	2026-06-13 13:59:33 -04:00
jcabillot	828cc447e0	Merge pull request 'fix: restore correct docker/setup-buildx-action checksum' (#10 ) from fix/restore-setup-buildx-checksum into master Main Release / tag (push) Failing after 3s Details Main Release / hadolint (push) Successful in 6s Details Main Release / test (push) Failing after 24s Details Main Release / build-push (push) Failing after 25s Details Reviewed-on: #10	2026-06-13 13:55:00 -04:00
cloudix_mcp_server	fb3216a876	fix: restore correct setup-buildx-action checksum (was corrupted in PR #9 ) PR Checks / hadolint (pull_request) Successful in 6s Details PR Checks / build-test (pull_request) Successful in 21s Details	2026-06-13 13:54:08 -04:00
jcabillot	9312c89ee9	Merge pull request 'fix(ci): use PAT instead of GITHUB_TOKEN for tag push to trigger tag.yaml' (#9 ) from fix/use-pat-for-tag-push into master Main Release / hadolint (push) Successful in 5s Details Main Release / build-push (push) Failing after 2s Details Main Release / test (push) Failing after 2s Details Main Release / tag (push) Failing after 2s Details Reviewed-on: #9	2026-06-13 13:51:25 -04:00
cloudix_mcp_server	58eb7fa4fb	fix: restore correct action checksums (metadata-action + build-push-action) PR Checks / hadolint (pull_request) Successful in 6s Details PR Checks / build-test (pull_request) Successful in 12s Details	2026-06-13 13:50:51 -04:00
cloudix_mcp_server	b00c43ee2d	fix: DEFAULT_BULB → DEFAULT_BUMP (typo) PR Checks / hadolint (pull_request) Successful in 5s Details PR Checks / build-test (pull_request) Successful in 11s Details	2026-06-13 13:48:00 -04:00
cloudix_mcp_server	594550dc6d	fix(ci): use PAT instead of GITHUB_TOKEN for tag push to trigger tag.yaml workflow PR Checks / hadolint (pull_request) Successful in 6s Details PR Checks / build-test (pull_request) Successful in 12s Details GITHUB_TOKEN is the internal actions runner token — pushes made with it don't trigger new workflow runs (by design, prevents infinite loops). Using a real user PAT (SA_TOKEN_ACTION_PUSH_TAGS) makes the tag push trigger the tag.yaml workflow correctly. Fixes the issue where tag pushes from the 'tag' job didn't launch the 'Tag Release' pipeline (tag.yaml).	2026-06-13 13:46:40 -04:00