[ci] Stop a manual mobile build from taking the released :latest tag - #5815
Merged
Conversation
`43 - Release to GHCR` in agenta_cloud is about to publish agenta-web-mobile alongside api, web, services and runner, which means it owns ghcr.io/agenta-ai/agenta-web-mobile:latest the same way it owns the other four. This workflow could also move that tag: a manual dispatch with push_latest=true retagged :latest onto an arbitrary build. Self-hosters pull :latest by default (the compose service defaults to it), so that is a footgun pointed at every opted-in self-host deployment, and it only got sharper once a released version started living there. Dispatch keeps building and pushing an explicit tag, which is what makes it useful for a preview or a one-off. It just cannot claim :latest any more.
dosubot
Bot
added
the
size:XS
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe mobile workflow now treats manual builds as ad hoc images. It removes the ChangesMobile image tag control
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7256dcb3-6823-4ce8-998e-a07620c1ea10
📒 Files selected for processing (1)
.github/workflows/17-check-mobile.yml
mmabrouk
approved these changes
Aug 8, 2026
… left behind
Dropping the push_latest input was not enough on its own: image_tag is free
text, so a dispatch with image_tag=latest sails through the existing
character/length validation and reaches the same imagetools create -t
"${IMAGE}:${TAG}" command, taking the tag by the other route. The prepare
job's metadata step now rejects TAG=latest outright, right after the
128-character check, so a manual build can no longer claim :latest by either
input.
That guard obsoletes two pieces of text that assumed push_latest still
existed. The build-image job's comment on why it depends on typecheck said
a passing dispatch "publishes that tag and merge-manifests can move latest
onto it" — merge-manifests can't move latest anymore, so the sentence now
says what actually happens: an image with unchecked types can still be
pushed, just never as latest. And the mobile design doc's first-publication
runbook still told an operator to dispatch this workflow with push=true,
push_latest=true — an input that no longer exists, describing exactly the
action this PR removes. It now points at 43 - Release to GHCR in
agenta_cloud, which is where publication actually lives, alongside api, web,
services and runner.
dosubot
Bot
added
size:S
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Agenta-AI/agenta_cloud#1665 adds
agenta-web-mobileto43 - Release to GHCR, so from v0.111 the release pipeline publishes the mobile image alongside api, web, services and runner. Part of publishing is movingghcr.io/agenta-ai/agenta-web-mobile:latestonto the released version, exactly as it does for the other four.This workflow could move that tag too. A manual dispatch with
push_latest=trueretagged:latestonto whatever commit was dispatched. That was harmless while nothing else owned the tag and no image had ever been published. It stops being harmless the moment a released version lives there.It matters because
:latestis the default a self-hoster gets:So a one-off build dispatched from a feature branch could quietly become what every opted-in self-host deployment pulls on its next restart.
Changes
Dropped the
push_latestinput and thelatestbranch of the manifest stitch. Dispatch still builds and pushes an explicit tag (manual-<short-sha>, or whateverimage_tagis set to), which is what makes it useful for a preview or a one-off. It just cannot claim:latestany more.The comment on
workflow_dispatchnow says where the release path actually is, so the next person does not have to reconstruct it.Nothing else changes. The PR-triggered path (typecheck, two-arch build,
/msmoke test, non-root check) is untouched, and dispatch never pushed:latestby default anyway, so no existing usage breaks.Tests / notes
run:block parses as bash, and no reference topush_latestorPUSH_LATESTsurvives anywhere in.github/orhosting/.Ordering: this is safe to merge before or after agenta_cloud#1665. Merged first it removes the footgun early; merged after it closes the window where two workflows both claim
:latest.While checking the related profile-name mismatch I found this repo is the consistent one. Every profile here is
with-prefixed (with-web,with-nginx,with-traefik,with-tunnel,with-web-mobile), so nothing needs renaming on this side. The cloud compose spells it bareweb-mobile, which is the side worth aligning, and that is a change for the other repo.