Only apply latest tag to container if it is the latest stable tag

Add a program to determine the latest stable tag and compare it to the tag
that triggered the workflow run. Only apply the latest tag if they match.

Update the workflow to apply the latest tag based on the results of that program.

This prevents new tags for older releases from getting the latst tag applied.

Author: samdoran

.github/workflows/build_and_push_release.yaml

@@ -31,14 +31,19 @@ jobs:
         with:
           # Fetch submodules (required for lightspeed-providers)
           submodules: 'recursive'
+          # Fetch all tags to determine latest stable version
+          fetch-tags: true
+      - name: Determine if latest tag should be applied
+        id: check_latest
+        run: ./scripts/latest-tag.py
       - name: Build image with Buildah
         id: build_image
         uses: redhat-actions/buildah-build@v2
         with:
           image: ${{ env.IMAGE_NAME }}
           tags: |
             ${{ env.GIT_TAG }}
-            ${{ env.LATEST_TAG }}
+            ${{ steps.check_latest.outputs.apply_latest == 'true' && env.LATEST_TAG || '' }}
           containerfiles: |
             ${{ env.CONTAINER_FILE }}
           archs: amd64, arm64

scripts/latest-tag.py

@@ -0,0 +1,55 @@
+#!/usr/bin/env python3
+
+import os
+import subprocess
+
+
+def version_split(value: str) -> tuple[int, ...]:
+    """Split string into a tuple of ints."""
+    try:
+        return tuple(int(n) for n in value.split("."))
+    except ValueError:
+        return (-1,)
+
+
+def is_prerelease(tag: str) -> bool:
+    """Determine if a tag is a pre-release version."""
+    omit = {"rc", "alpha", "beta", "dev"}
+
+    return any(n in tag for n in omit)
+
+
+def get_latest_stable() -> str | None:
+    """Return the latest stable tag."""
+    stdout = subprocess.check_output(["git", "tag"], text=True)
+    tags = [tag for tag in stdout.splitlines() if not is_prerelease(tag)]
+    tags.sort(key=version_split)
+
+    return tags[-1] if tags else None
+
+
+def main() -> None:
+    if not (current_tag := os.environ.get("GIT_TAG")):
+        reason = "GIT_TAG environment variable not set, skipping latest tag"
+        apply_latest = "false"
+    elif is_prerelease(current_tag):
+        reason = f"{current_tag} is a pre-release"
+        apply_latest = "false"
+    else:
+        latest_stable = get_latest_stable()
+        if current_tag == latest_stable:
+            reason = f"{current_tag} is the latest stable"
+            apply_latest = "true"
+        else:
+            reason = f"{current_tag} is not the latest stable ({latest_stable} is)"
+            apply_latest = "false"
+
+    print(reason)
+
+    if github_output := os.environ.get("GITHUB_OUTPUT"):
+        with open(github_output, "a") as f:
+            f.write(f"apply_latest={apply_latest}\n")
+
+
+if __name__ == "__main__":
+    main()