From 2b43d5dfd5dde89c1f1ab3b6f5794b64205ca79e Mon Sep 17 00:00:00 2001
From: "SREDevOps.org Agent" <sredevopsorgagents@sredevops.org>
Date: Mon, 26 Oct 2026 10:34:21 -0300
Subject: [PATCH] fix(ci): make release image digests unique and allow
 changelog PRs (#24)

The reusable image build ran once for the main image and once for the gateway in the same release run, but both used digests-<platform> artifact names, so the main merge downloaded a gateway digest and failed. Include a short hash of the full image name in the artifact name and download pattern.

The publish-release job also lacked pull-requests: write, so the generated CHANGELOG PR failed with 'Resource not accessible by integration'. Grant the job contents and pull-requests write.

Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
---
 .github/workflows/_build-image.yaml | 24 ++++++++++++++++++++----
 .github/workflows/release.yaml      |  3 +++
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/_build-image.yaml b/.github/workflows/_build-image.yaml
index 0864591..95c379e 100644
--- a/.github/workflows/_build-image.yaml
+++ b/.github/workflows/_build-image.yaml
@@ -60,8 +60,17 @@ jobs:
         run: |
           set -euo pipefail
           pair=$(printf '%s' "${{ matrix.platform }}" | tr '/' '-')
-          echo "PLATFORM_PAIR=$pair" >> "$GITHUB_ENV"
-          echo "CACHE_SCOPE=$(printf '%s' "$IMAGE" | tr '/' '-')" >> "$GITHUB_ENV"
+          # This reusable workflow runs once for the main image and once for the
+          # gateway in the same release run. Artifact names must include a
+          # unique token for the image: the repository path is a prefix of the
+          # gateway path, so a path-derived pattern would match both. Use a
+          # short hash of the full image name.
+          image_hash=$(printf '%s' "$IMAGE" | sha256sum | cut -c1-12)
+          {
+            echo "PLATFORM_PAIR=$pair"
+            echo "CACHE_SCOPE=$(printf '%s' "$IMAGE" | tr '/' '-')"
+            echo "ARTIFACT_PREFIX=$image_hash"
+          } >> "$GITHUB_ENV"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
@@ -101,7 +110,7 @@ jobs:
       - name: Upload digest
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: digests-${{ env.PLATFORM_PAIR }}
+          name: digests-${{ env.ARTIFACT_PREFIX }}-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -112,11 +121,18 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      - name: Prepare environment
+        env:
+          IMAGE: ${{ inputs.image }}
+        run: |
+          set -euo pipefail
+          echo "ARTIFACT_PREFIX=$(printf '%s' "$IMAGE" | sha256sum | cut -c1-12)" >> "$GITHUB_ENV"
+
       - name: Download digests
         uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: /tmp/digests
-          pattern: digests-*
+          pattern: digests-${{ env.ARTIFACT_PREFIX }}-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f1eebb7..ea24952 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -205,6 +205,9 @@ jobs:
     needs: [meta, build-main, build-gateway]
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1