From a843844ccbda536446de4a31cd43a658d9d474be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= <ffidencio@nvidia.com>
Date: Sat, 13 Jun 2026 12:52:30 +0200
Subject: [PATCH] ci: release: never move the "latest" image tag (testing)

Drop the "latest" tag from every release step that could publish it:
the per-arch kata-deploy images, the multi-arch kata-deploy manifest, and
the kata-monitor images/manifest. This guarantees a release run from this
branch can never move the "latest" tag of any published image while we test
the rest of the pipeline.
---
 .github/workflows/release-amd64.yaml       |  3 ++-
 .github/workflows/release-arm64.yaml       |  3 ++-
 .github/workflows/release-kata-images.yaml | 10 ++++++----
 .github/workflows/release-ppc64le.yaml     |  3 ++-
 .github/workflows/release-s390x.yaml       |  3 ++-
 .github/workflows/release.yaml             |  4 +++-
 6 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release-amd64.yaml b/.github/workflows/release-amd64.yaml
index 732f4983fb..35b52b0043 100644
--- a/.github/workflows/release-amd64.yaml
+++ b/.github/workflows/release-amd64.yaml
@@ -74,7 +74,8 @@ jobs:
           tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
           if [ "${tag}" = "main" ]; then
               tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
+              # TESTING: drop "latest" so a run from this branch never moves it.
+              tags=("${tag}")
           else
               tags=("${tag}")
           fi
diff --git a/.github/workflows/release-arm64.yaml b/.github/workflows/release-arm64.yaml
index 694067bd4c..90d905d546 100644
--- a/.github/workflows/release-arm64.yaml
+++ b/.github/workflows/release-arm64.yaml
@@ -74,7 +74,8 @@ jobs:
           tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
           if [ "${tag}" = "main" ]; then
               tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
+              # TESTING: drop "latest" so a run from this branch never moves it.
+              tags=("${tag}")
           else
               tags=("${tag}")
           fi
diff --git a/.github/workflows/release-kata-images.yaml b/.github/workflows/release-kata-images.yaml
index 20bcfcc285..33fa1fe51f 100644
--- a/.github/workflows/release-kata-images.yaml
+++ b/.github/workflows/release-kata-images.yaml
@@ -35,10 +35,10 @@ jobs:
           tag=$(echo "${GITHUB_REF}" | cut -d/ -f3-)
           if [ "${tag}" = "main" ]; then
             tag=$(./tools/packaging/release/release.sh release-version)
-            echo "tags=${tag} latest" >> "$GITHUB_OUTPUT"
-          else
-            echo "tags=${tag}" >> "$GITHUB_OUTPUT"
           fi
+          # TESTING: never include the "latest" tag so a run from this branch
+          # can never move the "latest" image tag.
+          echo "tags=${tag}" >> "$GITHUB_OUTPUT"
 
   publish-monitor:
     needs: resolve-tags
@@ -65,7 +65,9 @@ jobs:
       commit-hash: ${{ github.sha }}
       registry: quay.io
       repo: kata-containers/kata-monitor
-      tag: latest
+      # TESTING: fallback tag must not be "latest" so a run from this branch
+      # can never move the "latest" image tag (tags below overrides this anyway).
+      tag: ${{ needs.resolve-tags.outputs.tags }}
       tags: ${{ needs.resolve-tags.outputs.tags }}
       tag-suffix: ${{ matrix.tag_suffix }}
       runner: ${{ matrix.runner }}
diff --git a/.github/workflows/release-ppc64le.yaml b/.github/workflows/release-ppc64le.yaml
index e877eac449..6440e22cc6 100644
--- a/.github/workflows/release-ppc64le.yaml
+++ b/.github/workflows/release-ppc64le.yaml
@@ -71,7 +71,8 @@ jobs:
           tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
           if [ "${tag}" = "main" ]; then
               tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
+              # TESTING: drop "latest" so a run from this branch never moves it.
+              tags=("${tag}")
           else
               tags=("${tag}")
           fi
diff --git a/.github/workflows/release-s390x.yaml b/.github/workflows/release-s390x.yaml
index 2ca570b201..ffb0961e72 100644
--- a/.github/workflows/release-s390x.yaml
+++ b/.github/workflows/release-s390x.yaml
@@ -72,7 +72,8 @@ jobs:
           tag=$(echo "$GITHUB_REF" | cut -d/ -f3-)
           if [ "${tag}" = "main" ]; then
               tag=$(./tools/packaging/release/release.sh release-version)
-              tags=("${tag}" "latest")
+              # TESTING: drop "latest" so a run from this branch never moves it.
+              tags=("${tag}")
           else
               tags=("${tag}")
           fi
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 392aace9f4..0777950354 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -121,7 +121,9 @@ jobs:
       - name: Get the image tags
         run: |
           release_version=$(./tools/packaging/release/release.sh release-version)
-          echo "KATA_DEPLOY_IMAGE_TAGS=$release_version latest" >> "$GITHUB_ENV"
+          # TESTING: do NOT include the "latest" tag so a run from this branch
+          # can never move the "latest" image tag.
+          echo "KATA_DEPLOY_IMAGE_TAGS=$release_version" >> "$GITHUB_ENV"
 
       - name: Publish multi-arch manifest on quay.io & ghcr.io
         run: |