From e65d10017ddfdc086dd05bb4c3e804d0dfa338c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?=
 <david.barragan@kaleidos.net>
Date: Fri, 2 Oct 2026 09:12:31 +0000
Subject: [PATCH] :construction_worker: Use a slug of the ref for Docker tags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A git ref accepts characters that a Docker tag does not, such as "/" in
feature/foo, which made the promote and retag steps fail. Tag images with
a slug of the ref instead (anything outside [A-Za-z0-9._-] becomes "-",
at most 100 chars), as payments already does. develop, staging and
release tags are unchanged.

AI-assisted-by: Claude
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
---
 .github/workflows/build-docker.yml | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index a590606585..a794565d25 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -81,6 +81,7 @@ jobs:
     timeout-minutes: 15
     outputs:
       gh_ref: ${{ steps.vars.outputs.gh_ref }}
+      ref_slug: ${{ steps.vars.outputs.ref_slug }}
       bundle_version: ${{ steps.vars.outputs.bundle_version }}
       sha: ${{ steps.vars.outputs.sha }}
       short_sha: ${{ steps.vars.outputs.short_sha }}
@@ -100,7 +101,10 @@ jobs:
         env:
           GH_REF: ${{ inputs.gh_ref || github.ref_name }}
         run: |
+          # A git ref accepts characters that a Docker tag does not.
+          REF_SLUG=$(printf '%s' "$GH_REF" | tr -c 'A-Za-z0-9._-' '-' | cut -c1-100)
           echo "gh_ref=$GH_REF" >> $GITHUB_OUTPUT
+          echo "ref_slug=$REF_SLUG" >> $GITHUB_OUTPUT
           echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           echo "short_sha=$(git rev-parse --short=12 HEAD)" >> $GITHUB_OUTPUT
           echo "commit_title=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT
@@ -300,13 +304,13 @@ jobs:
       - name: Point branch tags to the new build key
         env:
           DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
-          GH_REF: ${{ needs.prepare.outputs.gh_ref }}
+          REF_SLUG: ${{ needs.prepare.outputs.ref_slug }}
           SHORT_SHA: ${{ needs.prepare.outputs.short_sha }}
         run: |
           set -e
           for image in $ALL_IMAGES; do
             docker buildx imagetools create \
-              -t "${DOCKER_REGISTRY}/${image}:${GH_REF}" \
+              -t "${DOCKER_REGISTRY}/${image}:${REF_SLUG}" \
               "${DOCKER_REGISTRY}/${image}:sha-${SHORT_SHA}"
           done
 
@@ -325,7 +329,7 @@ jobs:
 
       - name: Write step summary
         env:
-          GH_REF: ${{ needs.prepare.outputs.gh_ref }}
+          REF_SLUG: ${{ needs.prepare.outputs.ref_slug }}
           SHORT_SHA: ${{ needs.prepare.outputs.short_sha }}
           BUNDLE_VERSION: ${{ needs.prepare.outputs.bundle_version }}
           COMMIT_TITLE: ${{ needs.prepare.outputs.commit_title }}
@@ -337,7 +341,7 @@ jobs:
             echo "- Commit: [\`${SHORT_SHA}\`](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${SHORT_SHA}) — ${COMMIT_TITLE}"
             echo "- Built at: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
             echo ""
-            echo "All \`:${GH_REF}\` tags now point to \`sha-${SHORT_SHA}\`."
+            echo "All \`:${REF_SLUG}\` tags now point to \`sha-${SHORT_SHA}\`."
           } >> "$GITHUB_STEP_SUMMARY"
 
   # ── 3b. Skip path: make sure THIS ref's tags point to the existing
@@ -369,19 +373,19 @@ jobs:
       - name: Point branch tags to the existing build key
         env:
           DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
-          GH_REF: ${{ needs.prepare.outputs.gh_ref }}
+          REF_SLUG: ${{ needs.prepare.outputs.ref_slug }}
           SHORT_SHA: ${{ needs.prepare.outputs.short_sha }}
         run: |
           set -e
           for image in $ALL_IMAGES; do
             docker buildx imagetools create \
-              -t "${DOCKER_REGISTRY}/${image}:${GH_REF}" \
+              -t "${DOCKER_REGISTRY}/${image}:${REF_SLUG}" \
               "${DOCKER_REGISTRY}/${image}:sha-${SHORT_SHA}"
           done
 
       - name: Write step summary
         env:
-          GH_REF: ${{ needs.prepare.outputs.gh_ref }}
+          REF_SLUG: ${{ needs.prepare.outputs.ref_slug }}
           SHORT_SHA: ${{ needs.prepare.outputs.short_sha }}
           BUNDLE_VERSION: ${{ needs.prepare.outputs.bundle_version }}
           COMMIT_TITLE: ${{ needs.prepare.outputs.commit_title }}
@@ -393,7 +397,7 @@ jobs:
             echo "- Commit: [\`${SHORT_SHA}\`](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/commit/${SHORT_SHA}) — ${COMMIT_TITLE}"
             echo "- Checked at: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
             echo ""
-            echo "All \`:${GH_REF}\` tags now point to \`sha-${SHORT_SHA}\`."
+            echo "All \`:${REF_SLUG}\` tags now point to \`sha-${SHORT_SHA}\`."
           } >> "$GITHUB_STEP_SUMMARY"
 
   # ── 4. Single failure notification for the whole workflow ─────────────