From 967cb613ed90445e17af19f22d364d210e7a7e44 Mon Sep 17 00:00:00 2001
From: Xavier Guimard <yadd@debian.org>
Date: Wed, 1 Jul 2026 15:34:57 +0200
Subject: [PATCH] ci: block tag builds when tag != VERSION-DOCKERREVISION

Images and the Helm chart are versioned from VERSION-DOCKERREVISION in
docker-publish.yml, not from the git tag name. Add a check-tag gate that
fails a tag run when vX.Y.Z-N disagrees with that env, so a release tag can
never diverge from what is actually built and published. The job runs on all
events but only enforces on tags; test depends on it and everything depends on
test, so a mismatch blocks the whole pipeline.
---
 .github/workflows/docker-publish.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index b63cf1e..e1d5fb7 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -13,7 +13,31 @@ on:
       - 'v*'
 
 jobs:
+  # Gate for version tags: the images and the Helm chart are versioned from
+  # VERSION-DOCKERREVISION below, NOT from the git tag name. Refuse to run the
+  # whole pipeline if a pushed tag `vX.Y.Z-N` does not match that env, so a
+  # release tag can never disagree with what is actually built and published.
+  # The job always runs (only the check step is tag-gated), so branch builds
+  # pass it as a no-op; `test` depends on it, and every other job depends on
+  # `test`, so a mismatch blocks everything.
+  check-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Tag must equal v${VERSION}-${DOCKERREVISION}
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          expected="${VERSION}-${DOCKERREVISION}"
+          got="${GITHUB_REF_NAME#v}"
+          if [ "$got" != "$expected" ]; then
+            echo "::error::Tag '${GITHUB_REF_NAME}' does not match VERSION-DOCKERREVISION." \
+                 "Expected 'v${expected}'. Update env in" \
+                 ".github/workflows/docker-publish.yml (VERSION / DOCKERREVISION) or retag."
+            exit 1
+          fi
+          echo "Tag '${GITHUB_REF_NAME}' matches VERSION-DOCKERREVISION (${expected})."
+
   test:
+    needs: check-tag
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code