ci(publish): push a commit-sha tag on supervisor builds from main

[nicktrn]

Summary

Supervisor images built from main are only published under the mutable main tag, so there is no way to pin a deployment to the exact commit a build came from. The webapp publish already pushes a full commit-sha tag next to main for this reason. This adds the same block to the supervisor publish, so every main build is also available as ghcr.io/triggerdotdev/supervisor:<sha>.

Tag builds (re2-*, build-*, v4.x.y) are unchanged.

[changeset-bot]

⚠️ No Changeset found

Latest commit: ba5e6fe

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 15fceb10-d0c7-497a-9a7a-a9dbc641969a

📥 Commits

Reviewing files that changed from the base of the PR and between 11436a3 and ba5e6fe.

📒 Files selected for processing: 1

• .github/workflows/publish-worker-v4.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout: 6

• GitHub Check: code-quality / code-quality
• GitHub Check: Analyze (actions)
• GitHub Check: audit
• GitHub Check: audit
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Zizmor

🔇 Additional comments: 1

.github/workflows/publish-worker-v4.yml: 1

95-99: LGTM!

Walkthrough

When the resolved image tag is main, the workflow adds GITHUB_SHA as an additional image tag. Other tags remain unchanged.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to ba5e6

Main-branch supervisor builds will be available under both the mutable main tag and a commit-specific SHA tag, with other tag builds unchanged. No actionable merge risk is identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description clearly explains the change and its scope, but it omits the required issue reference, checklist, testing details, changelog section, and screenshots section.	Update the description to include the required template sections. Add the issue reference, complete the checklist, describe testing performed, provide a short changelog entry, and state whether screenshots are applicable.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the CI change: adding a commit-SHA tag to supervisor builds from main.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.