Apply latest tag only when the image tag matches a semantic version

[sukantoraymond]

Changes scripts/build_image.sh so :latest is only applied when the image tag matches a semantic version (e.g., v1.3.0). Master builds continue to be tagged as :master (and by commit hash), not :latest, unless FORCE_TAG_LATEST is set.

[Copilot]

Pull Request Overview

This PR modifies the Docker image tagging strategy to reserve the :latest tag for semantic version releases. Instead of tagging master branch builds as :latest, only images with semantic version tags (e.g., v1.3.0) will receive the :latest tag, unless explicitly forced via FORCE_TAG_LATEST.

Key changes:

• Updated the condition for applying :latest tag from master branch builds to semantic version releases
• Master branch builds will continue to be tagged with :master and commit hash, but not :latest

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[StephenButtolph]

I think it makes way more sense to latest to point to the most recent release, rather than master. Will defer to @maru-ava for reviewing the actual code tho

[maru-ava]

Changes scripts/build_image.sh so :latest is only applied when the image tag matches a semantic version (e.g., v1.3.0). Master builds continue to be tagged as :master (and by commit hash), not :latest, unless FORCE_TAG_LATEST is set.

This describes the what of the PR, but not the why. Given that latest is a floating image tag that should never be used in production, what is the rational behind ensuring that it only targets release tags?

[StephenButtolph]

This describes the what of the PR, but not the why. Given that latest is a floating image tag that should never be used in production, what is the rational behind ensuring that it only targets release tags?

I agree the description could be improved. This had come up during our 1<->1, so I can probably talk to the rationale.

I felt that "latest" being an alias of "master" is a bit unexpected (as master should probably not be consumed externally). Having it map to the latest release felt less error prone.

While depending on a floating tag is not generally recommended, it can be nice for ease of use. A potential alternative could be including a latest-stable release or something.

[maru-ava]

I felt that "latest" being an alias of "master" is a bit unexpected (as master should probably not be consumed externally). Having it map to the latest release felt less error prone.

While depending on a floating tag is not generally recommended, it can be nice for ease of use. A potential alternative could be including a latest-stable release or something.

Frankly, I'm not sure anyone has a good reason to use latest externally. It's a huge footgun for anybody not well-versed in how floating tags work. Maybe latest-stable and latest-unstable and remove latest entirely so folks know what they are getting into?

fwiw the bootstrap testing currently depends on latest being the last image published to master, whatever we decide there will need to be a floating tag that is updated every time a new image is build from HEAD of master.

[StephenButtolph]

whatever we decide there will need to be a floating tag that is updated every time a new image is build from HEAD of master.

That is the "master" tag no?

[StephenButtolph]

Maybe latest-stable ... and remove latest entirely so folks know what they are getting into?

I think that makes sense. Do you also think we should rename master to latest-unstable?

[maru-ava]

whatever we decide there will need to be a floating tag that is updated every time a new image is build from HEAD of master.

That is the "master" tag no?

I guess so, yeah, TIL we have a master tag.

[maru-ava]

Maybe latest-stable ... and remove latest entirely so folks know what they are getting into?

I think that makes sense. Do you also think we should rename master to latest-unstable?

I think that makes sense.

[sukantoraymond]

Maybe latest-stable ... and remove latest entirely so folks know what they are getting into?

I think that makes sense. Do you also think we should rename master to latest-unstable?

I think that makes sense.

So the only thing left is to change master to latest-unstable? @maru-ava

[maru-ava]

So the only thing left is to change master to latest-unstable? @maru-ava

I think this PR should change latest to latest-unstable as well. Where are we actually tagging master though?

[sukantoraymond]

So the only thing left is to change master to latest-unstable? @maru-ava

I think this PR should change latest to latest-unstable as well. Where are we actually tagging master though?

Master is already tagged at

${DOCKER_CMD} -t "$DOCKER_IMAGE:$commit_hash" -t "$DOCKER_IMAGE:$image_tag" \
              "$AVALANCHE_PATH" -f "$AVALANCHE_PATH/Dockerfile"

[sukantoraymond]

So the only thing left is to change master to latest-unstable? @maru-ava

I think this PR should change latest to latest-unstable as well. Where are we actually tagging master though?

I have now tagged master as "latest-unstable"

[maru-ava]

So the only thing left is to change master to latest-unstable? @maru-ava

I think this PR should change latest to latest-unstable as well. Where are we actually tagging master though?

I have now tagged master as "latest-unstable"

I wasn't asking for an additional tagging step. Something is already tagging master and that would ideally be changed to tag latest-unstable instead and we remove the master tag.

[StephenButtolph]

I wasn't asking for an additional tagging step. Something is already tagging master and that would ideally be changed to tag latest-unstable instead and we remove the master tag.

./scripts/image_tag.sh defines the the image_tag as the human readable name of the commit that is checked out (either using a branch name or with a tag).

The publish_docker_image job is triggered upon:

on:
  workflow_dispatch:
  push:
    tags:
      - "*"
    branches:
      - master
      - dev

So that's where the "master" tag is coming from.

[maru-ava]

Tagging DO NOT MERGE until I get the bootstrap monitor updated and deployed to target the master tag instead of latest.