Retire the bare preset tag

It moved with every build exactly like the new -latest tag, so builds carried
two tags meaning the same thing. Leaves one moving tag and one per-commit tag.

Author: mimartin12

.github/workflows/build-seeded-databases.yml

@@ -168,7 +168,7 @@ jobs:
           DB="${MATRIX_DATABASE}"
           SHA_SHORT="${GITHUB_SHA:0:7}"
           docker save \
-            "${_AZ_REGISTRY}/shot/seeded-${DB}:${TAG}" \
+            "${_AZ_REGISTRY}/shot/seeded-${DB}:${TAG}-latest" \
             "${_AZ_REGISTRY}/shot/seeded-${DB}:${TAG}-${SHA_SHORT}" \
             -o "seeded-${DB}-${TAG}-${SHA_SHORT}.tar"
 

util/SeederUtility/scripts/README.md

@@ -40,8 +40,8 @@ dotnet run --project .. -- preset --list --output json
 
 Each build produces two tags:
 
-- **Stable**: `seeded-{db}:{preset-name}` — e.g. `seeded-postgres:qa-dunder-mifflin-enterprise-full`
-- **Versioned**: `seeded-{db}:{preset-name}-{git-sha}` — e.g. `seeded-postgres:qa-dunder-mifflin-enterprise-full-abc1234`
+- **Latest**: `seeded-{db}:{preset-name}-latest` — e.g. `seeded-postgres:qa-dunder-mifflin-enterprise-full-latest`. Moves with every build.
+- **Versioned**: `seeded-{db}:{preset-name}-{git-sha}` — e.g. `seeded-postgres:qa-dunder-mifflin-enterprise-full-abc1234`. Immutable, so a deployment can pin a known build.
 
 Either tag works with any core bundle, because CI pins one data protection key for every build.
 
@@ -68,7 +68,7 @@ Start the database and point the application at the unpacked bundle:
 
 ```bash
 docker run -d -p 5432:5432 \
-  bitwardenprod.azurecr.io/shot/seeded-postgres:qa-dunder-mifflin-enterprise-full
+  bitwardenprod.azurecr.io/shot/seeded-postgres:qa-dunder-mifflin-enterprise-full-latest
 ```
 
 The seed runs on first boot for postgres, mysql, and mariadb, so the server accepts connections before the data is loaded. Poll for a seeded table rather than trusting `pg_isready`:
@@ -151,7 +151,7 @@ Start the database on a named network:
 
 ```bash
 docker network create bwlite
-docker run -d --name bwlite-db --network bwlite -p 5433:5432 bitwardenprod.azurecr.io/shot/seeded-postgres:scale-lg-balanced-wayne-enterprises
+docker run -d --name bwlite-db --network bwlite -p 5433:5432 bitwardenprod.azurecr.io/shot/seeded-postgres:scale-lg-balanced-wayne-enterprises-latest
 ```
 
 Start lite against it:
@@ -190,7 +190,7 @@ Swap the database in `bwdata/docker/docker-compose.override.yml`, which `run.sh`
 ```yaml
 services:
   mssql:
-    image: bitwardenprod.azurecr.io/shot/seeded-mssql:qa-dunder-mifflin-enterprise-full
+    image: bitwardenprod.azurecr.io/shot/seeded-mssql:qa-dunder-mifflin-enterprise-full-latest
 ```
 
 To pull that image, run `az acr login -n bitwardenprod` first. The registry refuses anonymous pulls, and `run.sh` runs `docker compose pull` on every start.
@@ -257,7 +257,7 @@ database:
   type: postgres  # or mariadb, sqlserver
   image:
     repository: bitwardenprod.azurecr.io/shot/seeded-postgres
-    tag: qa-dunder-mifflin-enterprise-full
+    tag: qa-dunder-mifflin-enterprise-full-latest
 ```
 
 ### Self-host chart
@@ -268,7 +268,7 @@ self-host:
   database:
     image:
       name: bitwardenprod.azurecr.io/shot/seeded-mssql
-      tag: qa-dunder-mifflin-enterprise-full
+      tag: qa-dunder-mifflin-enterprise-full-latest
 ```
 
 **Note**: Both charts also need the [core bundle](#core-bundle) unpacked at `/etc/bitwarden/core`. Login fails against seeded data without the data protection key.

util/SeederUtility/scripts/build-seeded-image.sh

@@ -62,7 +62,6 @@ esac
 # Sanitize preset name for Docker tag + container name: replace dots with dashes
 TAG="${PRESET_NAME//./-}"
 IMAGE_REPO="${REGISTRY}/shot/seeded-${DB_TYPE}"
-IMAGE_STABLE="${IMAGE_REPO}:${TAG}"
 IMAGE_VERSIONED="${IMAGE_REPO}:${TAG}-${GIT_SHA}"
 IMAGE_LATEST="${IMAGE_REPO}:${TAG}-latest"
 
@@ -85,7 +84,6 @@ trap cleanup EXIT
 PRESET_CATEGORY="${PRESET_NAME%%.*}"
 
 echo "==> Building seeded ${DB_TYPE} image for preset: ${PRESET_NAME}"
-echo "    Stable:    ${IMAGE_STABLE}"
 echo "    Versioned: ${IMAGE_VERSIONED}"
 echo "    Latest:    ${IMAGE_LATEST}"
 echo "    Git SHA:   ${GIT_SHA}"
@@ -112,29 +110,25 @@ _docker_build_and_push() {
         --build-arg "PRESET_CATEGORY=${PRESET_CATEGORY}" \
         --build-arg "GIT_SHA=${GIT_SHA}" \
         --build-arg "BUILD_DATE=${BUILD_DATE}" \
-        -t "${IMAGE_STABLE}" \
         -t "${IMAGE_VERSIONED}" \
         -t "${IMAGE_LATEST}" \
         "${WORK_DIR}" \
         --load
 
-    echo "==> Built: ${IMAGE_STABLE}"
     echo "==> Built: ${IMAGE_VERSIONED}"
     echo "==> Built: ${IMAGE_LATEST}"
 
     if [[ "${PUSH}" == "true" ]]; then
         # Caller is responsible for registry auth (e.g. `az acr login` in CI or
         # locally) before invoking with PUSH=true.
         echo "==> Pushing images"
-        docker push "${IMAGE_STABLE}"
         docker push "${IMAGE_VERSIONED}"
         docker push "${IMAGE_LATEST}"
-        echo "==> Pushed: ${IMAGE_STABLE}"
         echo "==> Pushed: ${IMAGE_VERSIONED}"
         echo "==> Pushed: ${IMAGE_LATEST}"
 
         # free up disk after push
-        docker rmi "${IMAGE_STABLE}" "${IMAGE_VERSIONED}" "${IMAGE_LATEST}" >/dev/null 2>&1 || true
+        docker rmi "${IMAGE_VERSIONED}" "${IMAGE_LATEST}" >/dev/null 2>&1 || true
     fi
 }