From d27b21e33bb48b26294f709967ed2b5b65c7ceb7 Mon Sep 17 00:00:00 2001
From: ddcat666 <26564566+ddcat666@users.noreply.github.com>
Date: Tue, 29 Sep 2026 13:21:41 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E5=8F=91=E5=B8=83=E6=B5=81=E7=A8=8B?=
 =?UTF-8?q?=20-=20Release=20tag=20=E5=BC=BA=E5=88=B6=E9=87=8D=E5=BB=BA?=
 =?UTF-8?q?=E9=95=9C=E5=83=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/publish-images.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-images.yml b/.github/workflows/publish-images.yml
index ecc3ff188..24aba594c 100644
--- a/.github/workflows/publish-images.yml
+++ b/.github/workflows/publish-images.yml
@@ -92,7 +92,9 @@ jobs:
         run: bash .github/scripts/resolve-image.sh "$IMAGE_REF"
       - name: Build and push immutable commit image
         id: build
-        if: steps.existing.outputs.found != 'true'
+        # A version tag is a release boundary: rebuild its image even if a SHA tag
+        # already exists, so a stale/corrupt SHA tag cannot be promoted as a release.
+        if: startsWith(github.ref, 'refs/tags/v') || steps.existing.outputs.found != 'true'
         uses: docker/build-push-action@v6
         with:
           context: .