From 21be4582aca992c0b2586afd7b9e6f6eb4e3ab7f Mon Sep 17 00:00:00 2001
From: Agustin Celentano <12614595+agustincelentano@users.noreply.github.com>
Date: Tue, 8 Sep 2026 09:27:52 -0300
Subject: [PATCH] ci(publish-images): register the release tag on every scope
 image artifact

The three np artifact create steps passed only the digest, so the global
artifacts for containers, scheduled-task and containers-datadog carry no
tag and cannot be resolved with `lookup = true` + meta.tag, unlike the
images published through release-publish-oci. Pass the release tag too.
---
 .github/workflows/publish-images.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
index f58c2251..626d0b26 100644
--- a/.github/workflows/publish-images.yml
+++ b/.github/workflows/publish-images.yml
@@ -1,7 +1,9 @@
 name: publish-images
 
 # Publishes every scope's worker image to ECR Public on each semver tag, then
-# registers each as an oci_image platform artifact (visible-to organization=*).
+# registers each as an oci_image platform artifact (visible-to organization=*)
+# carrying both the digest and the release tag, so packages can resolve it by
+# tag (`lookup = true` + meta.tag) instead of copying a digest around.
 # Same mold as scopes-lambda (publish-image.yml), fanned out to the 3 images:
 #
 #   scopes/containers            <- k8s/            (base; FROM worker-bridge + tooling)
@@ -71,6 +73,7 @@ jobs:
             --registry public.ecr.aws \
             --repository nullplatform/scopes/containers \
             --digest "${{ needs.containers.outputs.image_digest }}" \
+            --tag "${{ inputs.existing_tag || github.ref_name }}" \
             --visible-to "organization=*"
 
   # ── scheduled-task (standalone) ────────────────────────────────────────────
@@ -104,6 +107,7 @@ jobs:
             --registry public.ecr.aws \
             --repository nullplatform/scopes/scheduled-task \
             --digest "${{ needs.scheduled-task.outputs.image_digest }}" \
+            --tag "${{ inputs.existing_tag || github.ref_name }}" \
             --visible-to "organization=*"
 
   # ── containers-datadog (overlay) ───────────────────────────────────────────
@@ -139,6 +143,7 @@ jobs:
             --registry public.ecr.aws \
             --repository nullplatform/scopes/containers-datadog \
             --digest "${{ needs.containers-datadog.outputs.image_digest }}" \
+            --tag "${{ inputs.existing_tag || github.ref_name }}" \
             --visible-to "organization=*"
 
   # ── GitHub release with artifact metadata ──────────────────────────────────