From 2a93a3d3bb4eddb6920f9ad28eb98dbc6fa30f81 Mon Sep 17 00:00:00 2001
From: "marvel.yu" <marvelfisher@gmail.com>
Date: Tue, 9 Jun 2026 15:42:54 +0800
Subject: [PATCH] fix inputs.tag inject to run shell

---
 .github/workflows/docker_release.yml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker_release.yml b/.github/workflows/docker_release.yml
index 1e78da379..a7ed8d2f4 100644
--- a/.github/workflows/docker_release.yml
+++ b/.github/workflows/docker_release.yml
@@ -26,6 +26,17 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
 
+      - name: Verify checkout ref matches expected tag
+        env:
+          INPUT_TAG: ${{ inputs.tag || github.ref_name }}
+        run: |
+          EXPECTED="${INPUT_TAG}"
+          ACTUAL=$(git tag --points-at HEAD | head -1)
+          if [[ "$EXPECTED" != "$ACTUAL" ]]; then
+            echo "ERROR: HEAD does not point to expected tag $EXPECTED (got: $ACTUAL)"
+            exit 1
+          fi
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
 
@@ -41,8 +52,10 @@ jobs:
 
       - name: Extract version and commit
         id: meta
+        env:
+          INPUT_TAG: ${{ inputs.tag || github.ref_name }}
         run: |
-          TAG="${{ inputs.tag || github.ref_name }}"
+          TAG="${INPUT_TAG}"
           if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]]; then
             echo "Invalid release tag: $TAG (expected e.g. v0.5.0)"
             exit 1
@@ -61,6 +74,6 @@ jobs:
           push: true
           tags: |
             ${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
-            ${{ env.IMAGE_NAME }}:latest
+            ${{ github.event_name == 'push' && format('{0}:latest', env.IMAGE_NAME) || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max