f026f8c30fpush-image-by-digest pushes the manifest to a :build-tmp tag to capture its digest without advertising a version tag pre-signing, but nothing ever removed it — so :build-tmp lingered in the registry tag list, pointing at the most recent pushed digest (defeating part of the L1 TOCTOU intent and cluttering the package view). promote-image-tag now deletes :build-tmp after the permanent vX.Y.Z tag points at the same digest (best-effort; tolerates absence on re-runs). |
||
|---|---|---|
| .. | ||
| release-tools/tasks | ||
| tasks | ||
| code-scans.yaml | ||
| on-pull-request.yaml | ||
| on-push-to-main.yaml | ||
| on-tag-push-release.yaml | ||
| openspec-validate-pr.yaml | ||
| openspec-validate-push.yaml | ||
| release-tools-on-pull-request-build.yaml | ||
| release-tools-on-tag-publish.yaml | ||
| repository.yaml | ||