From babd9e7a79ad62149bdf0b53238dfdba47d6fa6a Mon Sep 17 00:00:00 2001
From: Tom Piccirello <8296030+Piccirello@users.noreply.github.com>
Date: Sat, 24 Oct 2026 11:21:43 -0700
Subject: [PATCH] fix(ci): give rasterizer rebuilds run-scoped image tags
 (#123081)

---
 .../ci-recording-rasterizer-container.yml     | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-recording-rasterizer-container.yml b/.github/workflows/ci-recording-rasterizer-container.yml
index b2fed4a55395..2d4f98159ed9 100644
--- a/.github/workflows/ci-recording-rasterizer-container.yml
+++ b/.github/workflows/ci-recording-rasterizer-container.yml
@@ -145,6 +145,28 @@ jobs:
                   # Prod deploys from private ECR; pause the public ghcr push during an embargo.
                   push-to-ghcr: ${{ vars.PUBLIC_IMAGE_PUSH_PAUSED != 'true' }}
 
+            # The push build of a commit already holds its commit tags, and ECR refuses to move a commit tag
+            # to a new digest. A scheduled or manual rebuild of that commit therefore pushes tags that carry
+            # the run ID. The deploy pins the digest, so the tag name does not change what runs.
+            - name: Scope rebuild tags to this run
+              id: tags
+              env:
+                  TAGS: ${{ steps.docker-meta.outputs.tags }}
+                  EVENT_NAME: ${{ github.event_name }}
+                  COMMIT_SHA: ${{ github.sha }}
+                  RUN_ID: ${{ github.run_id }}
+              run: |
+                  if [ "$EVENT_NAME" = "schedule" ] || [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+                    run_tags="$(sed -E "s/:(sha-)?${COMMIT_SHA}\$/:\1${COMMIT_SHA}-refresh-${RUN_ID}/" <<<"$TAGS")"
+                  else
+                    run_tags="$TAGS"
+                  fi
+                  {
+                    echo "tags<<TAGS_EOF"
+                    echo "$run_tags"
+                    echo "TAGS_EOF"
+                  } >> "$GITHUB_OUTPUT"
+
             - name: Build and push container image
               id: build
               uses: depot/build-push-action@5f3b3c2e5a00f0093de47f657aeaefcedff27d18 # v1.17.0
@@ -154,7 +176,7 @@ jobs:
                   project: '00mrvlsdvh'
                   push: ${{ github.event_name == 'pull_request' || vars.CD_DEPLOY_ENABLED == 'true' }}
                   file: Dockerfile.recording-rasterizer
-                  tags: ${{ steps.docker-meta.outputs.tags }}
+                  tags: ${{ steps.tags.outputs.tags }}
                   labels: ${{ steps.docker-meta.outputs.labels }}
                   annotations: ${{ steps.docker-meta.outputs.annotations }}
                   platforms: linux/amd64