Two main merges built minutes apart both computed the same GitVersion
version. The later pipeline overwrote the image tag in GHCR, github-release
tagged whatever main pointed at (--target main), and the GitOps bump was a
no-op, so production ran an image without the later merge (Website-Backend
0.1.24 and 0.1.32).
- allocate_version: on main, reserve vX.Y.Z by creating the git tag through
the GitHub refs API (create-if-absent). On conflict with another commit,
take the next patch; reruns of the same commit reuse their tag. Existing
tags are never moved. Runs in mvn/gradle/node build-and-test before the
version is baked into artifacts.
- guard_image_tags: refuse to push a main or supplemental version tag that
already exists for a different commit (org.opencontainers.image.revision
label, now set on every build); fail closed on registry errors.
- update_cd_repo: verify vX.Y.Z belongs to this commit before bumping the
GitOps repo; record the source commit in the GitOps commit message.
- github_release: target CIRCLE_SHA1 instead of main and refuse when the tag
points elsewhere.
- Generator: render cd_path only when cd.path is set, so manifests pinned to
orb versions predating the parameter (website develop branches, Concilium,
makers4) stop failing with "Unexpected argument(s): cd_path".
Tests: tests/test_allocate_version.sh (incl. 8 concurrent allocators against
an atomic fake refs API) and tests/test_release_guards.sh.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5