From b4d43816152f424414b7e8596cd6fd6abacd825a Mon Sep 17 00:00:00 2001
From: Yordis Prieto <yordis.prieto@gmail.com>
Date: Tue, 1 Sep 2026 20:28:32 -0400
Subject: [PATCH] fix(release): keep container version selection explicit

Signed-off-by: Yordis Prieto <yordis.prieto@gmail.com>
---
 .../tasks/github-actions/publish-container    |  4 +-
 .../github-actions/publish-container-test     | 49 +++++++++++++++++++
 .github/workflows/common.yml                  |  2 +
 3 files changed, 52 insertions(+), 3 deletions(-)
 create mode 100755 .config/mise/tasks/github-actions/publish-container-test

diff --git a/.config/mise/tasks/github-actions/publish-container b/.config/mise/tasks/github-actions/publish-container
index 8b427d54b..e0a36a06c 100755
--- a/.config/mise/tasks/github-actions/publish-container
+++ b/.config/mise/tasks/github-actions/publish-container
@@ -12,15 +12,13 @@ tags=()
 if [[ "$GITHUB_REF" == refs/heads/master ]]; then
 	tags+=(ci)
 elif [[ "$GITHUB_REF" =~ ^refs/tags/v([0-9]+)\.([0-9]+)\.([0-9]+)(-[0-9A-Za-z.-]+)?$ ]]; then
-	major=${BASH_REMATCH[1]}
-	minor=${BASH_REMATCH[2]}
 	version=${GITHUB_REF_NAME#v}
 	tags+=("$version")
 
 	if [[ "$version" == *-* ]]; then
 		tags+=(preview)
 	else
-		tags+=("$major.$minor" "$major" stable)
+		tags+=(latest)
 	fi
 else
 	echo "Unsupported image publication ref: $GITHUB_REF" >&2
diff --git a/.config/mise/tasks/github-actions/publish-container-test b/.config/mise/tasks/github-actions/publish-container-test
new file mode 100755
index 000000000..421117718
--- /dev/null
+++ b/.config/mise/tasks/github-actions/publish-container-test
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+#MISE description="Verify container tags implied by GitHub refs"
+
+set -euo pipefail
+
+task_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+publish_task="$task_dir/publish-container"
+image=ghcr.io/trogonstack/trogoneventstore
+
+run_publish() {
+	local ref=$1
+	local ref_name=$2
+
+	GITHUB_REF="$ref" \
+		GITHUB_REF_NAME="$ref_name" \
+		IMAGE="$image" \
+		PUBLISH_TASK="$publish_task" \
+		bash -c '
+			docker() {
+				printf "%s\n" "$*"
+			}
+
+			source "$PUBLISH_TASK"
+		'
+}
+
+stable=$(run_publish refs/tags/v0.0.2 v0.0.2)
+expected_stable=$(printf '%s\n' \
+	"tag eventstore $image:0.0.2" \
+	"push $image:0.0.2" \
+	"tag eventstore $image:latest" \
+	"push $image:latest")
+
+if [[ "$stable" != "$expected_stable" ]]; then
+	printf 'Unexpected stable release commands:\n%s\n' "$stable" >&2
+	exit 1
+fi
+
+prerelease=$(run_publish refs/tags/v0.0.3-rc.1 v0.0.3-rc.1)
+expected_prerelease=$(printf '%s\n' \
+	"tag eventstore $image:0.0.3-rc.1" \
+	"push $image:0.0.3-rc.1" \
+	"tag eventstore $image:preview" \
+	"push $image:preview")
+
+if [[ "$prerelease" != "$expected_prerelease" ]]; then
+	printf 'Unexpected prerelease commands:\n%s\n' "$prerelease" >&2
+	exit 1
+fi
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 78d4a7865..6958731eb 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -139,6 +139,8 @@ jobs:
           cache: false
       - name: Verify release metadata
         run: mise run --skip-tools release-metadata:check
+      - name: Verify container publication tags
+        run: mise run --skip-tools github-actions:publish-container-test
 
   archive-storage-contract:
     runs-on: ubuntu-latest