From 72be27948fd777619019b7c9bf3b84ffdfd048a5 Mon Sep 17 00:00:00 2001 From: AminDhouib Date: Fri, 11 Sep 2026 11:13:43 -0400 Subject: [PATCH] ci: do not republish the dokploy image for docs-only pushes to canary This workflow retags canary, latest and the package.json version on every push to canary, so a merge that changes only markdown moves all three tags to a new digest. That breaks the procedure that depends on those tags being stable: capturing the digest the live instance is running before a version roll, so there is something to roll back to. The pre-#209 image is already untagged for exactly this reason. Adds paths-ignore for docs/** to the push trigger. workflow_dispatch is untouched, so a deliberate rebuild remains available. --- .github/workflows/dokploy.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/dokploy.yml b/.github/workflows/dokploy.yml index 148e77e22a..ada3d694bd 100644 --- a/.github/workflows/dokploy.yml +++ b/.github/workflows/dokploy.yml @@ -3,6 +3,18 @@ name: Dokploy Docker Build on: push: branches: [canary] + # A docs-only merge must not republish the image. This workflow retags + # `canary`, `latest` and the package.json version on every push, so any + # merge to canary moves all three to a new digest - including a merge that + # changes nothing the image contains. That breaks the one operating + # procedure that depends on those tags being stable: capturing the running + # digest before a version roll, so there is something to roll back to. + # See docs/build-once-rollout-runbook.md, section 2.1. + # + # workflow_dispatch is untouched, so a deliberate rebuild is always one + # click away. + paths-ignore: + - "docs/**" workflow_dispatch: env: