ci: wait for concurrent candidate publication

2026-08-24 09:40:35 +02:00
parent b6a550e9a3
commit 8f8110fb67
4 changed files with 89 additions and 6 deletions
@@ -88,3 +88,8 @@ Use manifest version 2 when one image serves multiple applications or Production
 ```

 Candidate pipelines build every artifact once, push `sha-<commit>`, resolve the registry digest and deploy applications in dependency order. A pull request into a promotion branch must originate from `source.branch`; it pulls and verifies the already tested `sha-<commit>` candidates without rebuilding or deploying them. Promotion pushes require a merge parent with an identical Git tree, pull the existing candidate, verify required container files, add the SemVer alias, deploy the exact digests, create the immutable tag and publish the canonical Gitea release. Tag creation does not trigger another scoped pipeline because the workflow listens only to branch pushes.
+
+When a promotion pull request and its source-branch push start concurrently, the
+pull-request check waits for the immutable candidate tag to become available.
+This bounded retry applies only to promotion pull requests; an actual promotion
+still fails immediately when its tested candidate is missing.