From ba5e6fe822b3e4d1f5cd344a89299055ac749680 Mon Sep 17 00:00:00 2001
From: nicktrn <55853254+nicktrn@users.noreply.github.com>
Date: Wed, 14 Oct 2026 10:35:47 +0100
Subject: [PATCH] ci(publish): push a commit-sha tag on supervisor builds from
 main

Matches the webapp publish, which already pushes an immutable full-sha tag next to the mutable main tag so a build can be pinned by commit.
---
 .github/workflows/publish-worker-v4.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/publish-worker-v4.yml b/.github/workflows/publish-worker-v4.yml
index 43844c8f4c4..2f1943fe478 100644
--- a/.github/workflows/publish-worker-v4.yml
+++ b/.github/workflows/publish-worker-v4.yml
@@ -92,6 +92,12 @@ jobs:
             image_tags=$image_tags,$ref_without_tag:v4,$ref_without_tag:latest
           fi
 
+          # when pushing the mutable main tag, also push an immutable-by-convention
+          # full-commit-sha tag so a commit can be resolved to a specific digest
+          if [[ "${STEPS_GET_TAG_OUTPUTS_TAG}" == "main" ]]; then
+            image_tags=$image_tags,$ref_without_tag:${GITHUB_SHA}
+          fi
+
           echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
           echo "image_repo=${ref_without_tag}" >> "$GITHUB_OUTPUT"
         env: