retag.yml

name: Retag Image

# Manually retag an existing image digest to one or more target tags without
# rebuilding. Use cases:
#   - Re-point :latest to a previous release after a bad release
#   - Emergency: promote a known-good digest to a specific tag

on:
  workflow_dispatch:
    inputs:
      source-digest:
        description: "Source image digest (e.g. sha256:abc123...)"
        required: true
        type: string
      target-tags:
        description: "Space-separated target tags (e.g. 'latest v1.0.0 1.0')"
        required: true
        type: string

permissions:
  contents: read

jobs:
  retag:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # ratchet:docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # ratchet:docker/setup-buildx-action@v4

      - name: Retag
        run: |
          SOURCE="ghcr.io/${{ github.repository }}@${{ inputs.source-digest }}"
          TAG_ARGS=""
          for tag in ${{ inputs.target-tags }}; do
            TAG_ARGS="$TAG_ARGS --tag ghcr.io/${{ github.repository }}:${tag}"
          done
          echo "Retagging ${SOURCE} -> ${{ inputs.target-tags }}"
          docker buildx imagetools create ${TAG_ARGS} ${SOURCE}