fix(build): pre-flight tag existence check + restore continue-on-signing-failure

[bedatty]

Description

Fixes the two root causes of the tenant-manager 2.2.0-beta.6 two-attempt failure (run) — both confirmed from the run's job annotations.

Attempt #2 — wasted rebuild on an immutable tag. A re-run rebuilt the image (~19s) then failed at push because DockerHub tag immutability rejected the already-published tag. New on_existing_tag input adds a pre-flight existence check (via docker manifest inspect, reusing the registry logins) before the build:

• fail (default): abort early with a clear error instead of rebuilding then failing at push.
• skip: skip build/push but still emit the GitOps tag artifacts (from the version) so a re-run stays idempotent for the downstream GitOps update.
• warn: warn and build anyway.

A non-existent tag — or a check that errors (transient registry issues) — is treated as "not present", so the check never blocks a legitimate build.

Attempt #1 secondary error — broken continue_gitops_on_signing_failure. When cosign signing failed, the job died with The template is not valid … build.yml@v1.31.0 (Line: 372, Col: 28): Unexpected value '' / an error occurred when attempting to determine whether to continue on error. Root cause (verified): a workflow_call boolean input interpolated into a step-level continue-on-error renders empty when evaluated at failure time — a known GitHub Actions quirk — so the very feature meant to tolerate a Sigstore/Rekor outage was itself broken at the moment of failure. Fixed by coercing to a guaranteed boolean: continue-on-error: ${{ inputs.continue_gitops_on_signing_failure || false }}.

Files:

• .github/workflows/build.yml — new on_existing_tag input; pre-flight tag check step; should_build gating of metadata/build-push/cosign steps (GitOps artifact steps stay so skip remains idempotent); continue-on-error boolean coercion.
• docs/build-workflow.md — on_existing_tag row + "Tag Immutability and Re-runs" section.

Scope / relationship to #421

#421 is an umbrella covering several loosely-related fixes. This PR delivers the two incident root-cause fixes (attempt #1 template error, attempt #2 tag check). The remaining items are split into focused issues:

• build: cosign retry resilience — add jitter and raise max-attempts default #450 — cosign retry resilience (jitter + higher cosign_max_attempts default).
• build: optional cleanup_on_failure for pushed images on downstream failure #451 — optional cleanup_on_failure for pushed images (high-risk, originally a suggestion).

#421 will be closed as superseded by this PR + #450 + #451.

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

on_existing_tag defaults to fail, so a re-run whose target tag already exists now fails fast before building. Previously such a re-run either failed at push (immutable registries — same red, just later) or overwrote the tag (mutable registries). Repos that intentionally re-push/overwrite a tag must set on_existing_tag: warn (or skip).

This propagates to go-release.yml callers, which call build.yml without on_existing_tag and therefore inherit fail. go-release does not yet expose a passthrough to override it; that can be added as a follow-up if a caller needs skip/warn.

Testing

• YAML syntax validated locally
• Rendered and reviewed the pre-flight shell script; verified should_build gating across metadata/build-push/cosign while GitOps artifact steps remain (idempotent skip)
• Root cause of the line-372 template error confirmed against the actual tenant-manager run annotations (not assumed)
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run: Pending — to validate on a re-run against an already-published tag (fail/skip/warn) and a cosign-failure path (continue-on-error no longer template-errors).

Related Issues

Part of #421 (closed as superseded). Follow-ups: #450, #451.

[coderabbitai]

Warning

Review limit reached

@bedatty, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 33 minutes and 52 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: da9fba89-467b-42a6-ae93-5b4e805e37e7

📥 Commits

Reviewing files that changed from the base of the PR and between 47c4110 and 80ee15b.

📒 Files selected for processing (2)

• .github/workflows/build.yml
• docs/build-workflow.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/build-preflight-tag-and-cosign-continue

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	1 file(s)	✅ success
Action Lint	1 file(s)	✅ success
Pinned Actions	1 file(s)	✅ success
Markdown Link Check	1 file(s)	✅ success
Spelling Check	2 file(s)	✅ success
Shell Check	1 file(s)	✅ success
README Check	1 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

---

_{🔍 View full scan logs | 🛡️ Security tab}