From 8de7ccd07da1d788fd9d73e31cd7190876d9c676 Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Mon, 1 Jun 2026 01:28:55 -0400
Subject: [PATCH] build(ci): per-commit :c-<short_sha> tag on main-push per
 family rule #46
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds an immutable per-commit docker tag to every main-push build:
`git.fabledsword.com/bvandeusen/fabledcurator{,-ml}:c-<short_sha>`,
alongside the existing floating `:main` + `:latest`. Implements the
new family release-posture rule "Tags are milestones, not gates —
commit-SHA images are the rollback unit" so rollback to any commit
on main is `docker pull …:c-<sha>` with no release ceremony required.

Behavior change summary:
- main-push: was {:main, :latest} → now {:main, :latest, :c-<short_sha>}
- tag-push (opt-in vYY.MM.DD only, no .N): unchanged
- safety-net dev: unchanged

No code changes; the rule is about how the tag list is constructed.
Tag-push workflows stay as-is — vYY.MM.DD milestone cuts can still
fire them when the operator wants a labeled checkpoint.
---
 .forgejo/workflows/build.yml | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 2bf6248..861b15f 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -242,20 +242,28 @@ jobs:
         id: tag
         run: |
           # Three trigger shapes:
-          #   refs/tags/v…   → tag-push: publish ONLY the immutable version
-          #                    tag (e.g. :v26.05.26.5). Don't touch :latest;
-          #                    that already got published by the main-push
-          #                    build for the merge commit.
-          #   refs/heads/main → push to main (incl. PR merge commits):
-          #                    publish :main + :latest (floating).
+          #   refs/tags/v…   → tag-push: opt-in milestone label (vYY.MM.DD,
+          #                    no `.N` per family release-posture rule).
+          #                    Publish ONLY the immutable version tag;
+          #                    don't touch :latest (the main-push build
+          #                    for the merge commit already did that).
+          #   refs/heads/main → push to main: publish :main + :latest
+          #                    (floating) AND :c-<short_sha> (immutable
+          #                    per-commit rollback substrate, per family
+          #                    release-posture rule "Tags are milestones,
+          #                    not gates — commit-SHA images are the
+          #                    rollback unit"). Rollback to any commit
+          #                    becomes `docker pull …:c-<sha>` without a
+          #                    release ceremony.
           #   anything else  → safety net; shouldn't fire given the `on:`
-          #                    config above (dev was dropped). Tag :dev to
-          #                    surface the unexpected run in the registry.
+          #                    config above. Tag :dev to surface the
+          #                    unexpected run in the registry.
+          SHORT_SHA="${GITHUB_SHA:0:7}"
           if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
             TAG_NAME="${GITHUB_REF#refs/tags/}"
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:${TAG_NAME}" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest" >> "$GITHUB_OUTPUT"
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:main,git.fabledsword.com/bvandeusen/fabledcurator:latest,git.fabledsword.com/bvandeusen/fabledcurator:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator:dev" >> "$GITHUB_OUTPUT"
           fi
@@ -286,13 +294,15 @@ jobs:
         id: tag
         run: |
           # Mirrors build-web's three-shape logic (tag-push / main-push /
-          # safety-net dev). The -ml image follows the same release cadence
-          # as the web image.
+          # safety-net dev) including the per-commit :c-<short_sha> tag
+          # on main-push per the family release-posture rule. The -ml
+          # image follows the same release cadence as the web image.
+          SHORT_SHA="${GITHUB_SHA:0:7}"
           if [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF}" ]; then
             TAG_NAME="${GITHUB_REF#refs/tags/}"
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:${TAG_NAME}" >> "$GITHUB_OUTPUT"
           elif [ "${GITHUB_REF##*/}" = "main" ]; then
-            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest" >> "$GITHUB_OUTPUT"
+            echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:main,git.fabledsword.com/bvandeusen/fabledcurator-ml:latest,git.fabledsword.com/bvandeusen/fabledcurator-ml:c-${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           else
             echo "tags=git.fabledsword.com/bvandeusen/fabledcurator-ml:dev" >> "$GITHUB_OUTPUT"
           fi