fix(ci): give rasterizer rebuilds run-scoped image tags (#123081)

.github/workflows/ci-recording-rasterizer-container.yml

@@ -145,6 +145,28 @@ jobs:
                   # Prod deploys from private ECR; pause the public ghcr push during an embargo.
                   push-to-ghcr: ${{ vars.PUBLIC_IMAGE_PUSH_PAUSED != 'true' }}
 
+            # The push build of a commit already holds its commit tags, and ECR refuses to move a commit tag
+            # to a new digest. A scheduled or manual rebuild of that commit therefore pushes tags that carry
+            # the run ID. The deploy pins the digest, so the tag name does not change what runs.
+            - name: Scope rebuild tags to this run
+              id: tags
+              env:
+                  TAGS: ${{ steps.docker-meta.outputs.tags }}
+                  EVENT_NAME: ${{ github.event_name }}
+                  COMMIT_SHA: ${{ github.sha }}
+                  RUN_ID: ${{ github.run_id }}
+              run: |
+                  if [ "$EVENT_NAME" = "schedule" ] || [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+                    run_tags="$(sed -E "s/:(sha-)?${COMMIT_SHA}\$/:\1${COMMIT_SHA}-refresh-${RUN_ID}/" <<<"$TAGS")"
+                  else
+                    run_tags="$TAGS"
+                  fi
+                  {
+                    echo "tags<<TAGS_EOF"
+                    echo "$run_tags"
+                    echo "TAGS_EOF"
+                  } >> "$GITHUB_OUTPUT"
+
             - name: Build and push container image
               id: build
               uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
@@ -154,7 +176,7 @@ jobs:
                   project: '00mrvlsdvh'
                   push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
                   file: Dockerfile.recording-rasterizer
-                  tags: ${{ steps.docker-meta.outputs.tags }}
+                  tags: ${{ steps.tags.outputs.tags }}
                   labels: ${{ steps.docker-meta.outputs.labels }}
                   annotations: ${{ steps.docker-meta.outputs.annotations }}
                   platforms: linux/amd64