ci: block tag builds when tag != VERSION-DOCKERREVISION

[guimard]

What

Adds a check-tag gate job to .github/workflows/docker-publish.yml.

On a version tag (v*), it fails the run unless the tag matches
VERSION-DOCKERREVISION from the workflow env — e.g. with VERSION: 2.23.0
and DOCKERREVISION: 2, only v2.23.0-2 is allowed.

Why

Both the Docker image tags (via docker-common) and the Helm chart (via the
publish-helm job) are versioned from VERSION-DOCKERREVISION, not from the
git tag name. A tag whose name disagrees with that env would build/publish
under a different version than the tag implies (or, before the env-based Helm
fix, reference images that don't exist). This gate makes such a mismatch fail
fast instead of producing a misleading release.

How

• check-tag always runs, but the check step is guarded by
  if: startsWith(github.ref, 'refs/tags/') → it's a no-op success on branch
  pushes.
• test now needs: check-tag, and every other job transitively depends on
  test, so a mismatch blocks the entire pipeline (build + publish-helm).

Behaviour

Env	Tag	Result
2.23.0 / 2	v2.23.0-2	✅ runs
2.23.0 / 2	v2.23.0-3	❌ blocked
any	branch push	✅ no-op

To release: bump VERSION/DOCKERREVISION and tag v<VERSION>-<DOCKERREVISION>.

Summary by CodeRabbit

• Chores
  • Added tag-format validation to the release workflow to ensure version tags follow the expected vX.Y.Z-REVISION pattern.
  • Prevented downstream release steps from running when a pushed tag does not match the required format.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a check-tag job to the docker-publish GitHub Actions workflow that validates pushed tags match the format v${VERSION}-${DOCKERREVISION}, failing on mismatch. The test job now depends on check-tag via needs.

Changes

CI Tag Validation Workflow

Layer / File(s)	Summary
Tag format check and job gating .github/workflows/docker-publish.yml	Adds a check-tag job that validates tag refs against v${VERSION}-${DOCKERREVISION} format, exiting with an error on mismatch, and updates the test job to depend on check-tag via needs.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Related PRs: None found.

Suggested labels: ci, github-actions

Suggested reviewers: guimard

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main workflow change: blocking tag builds when the tag does not match the expected version format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/check-tag-consistency

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/docker-publish.yml (1)

23-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add explicit least-privilege permissions to check-tag.

Static analysis flags this job for using default (potentially broad) GITHUB_TOKEN permissions since no permissions: block is set. This job only runs a shell comparison and doesn't need any token scopes.

🔒 Proposed fix

  check-tag:
    runs-on: ubuntu-latest
+   permissions: {}
    steps:
      - name: Tag must equal v${VERSION}-${DOCKERREVISION}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/docker-publish.yml around lines 23 - 37, The check-tag job
currently relies on the default GITHUB_TOKEN scope even though it only performs
a shell-based tag comparison. Add an explicit permissions block to the check-tag
job in docker-publish.yml that sets the job to least privilege (no token scopes
needed), keeping the existing tag validation logic in the Tag must equal
v${VERSION}-${DOCKERREVISION} step unchanged.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/docker-publish.yml:
- Around line 23-37: The check-tag job currently relies on the default
GITHUB_TOKEN scope even though it only performs a shell-based tag comparison.
Add an explicit permissions block to the check-tag job in docker-publish.yml
that sets the job to least privilege (no token scopes needed), keeping the
existing tag validation logic in the Tag must equal
v${VERSION}-${DOCKERREVISION} step unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a8ed1164-afa6-4b4a-ab71-c6259bb06086

📥 Commits

Reviewing files that changed from the base of the PR and between 255234a and 967cb61.

📒 Files selected for processing (1)

• .github/workflows/docker-publish.yml