From 47b35f48dc30ea459d92f4e3fb03b773aaa94e61 Mon Sep 17 00:00:00 2001
From: Dan Kluser <d@kluser.ch>
Date: Tue, 2 Jun 2026 21:53:31 +0200
Subject: [PATCH] ci: move release commit tag

---
 .github/workflows/build-image.yml      | 16 +++++++++++++
 .github/workflows/move-release-tag.yml | 33 ++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/move-release-tag.yml

diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 743d846..5079754 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -169,6 +169,22 @@ jobs:
             echo 'EOF'
           } >> "$GITHUB_OUTPUT"
 
+      - name: Move latest tag to current commit
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const ref = 'tags/latest';
+            try {
+              await github.rest.git.updateRef({
+                ...context.repo, ref, sha: context.sha, force: true,
+              });
+            } catch (e) {
+              if (e.status !== 422) throw e;
+              await github.rest.git.createRef({
+                ...context.repo, ref: 'refs/tags/latest', sha: context.sha,
+              });
+            }
+
       - name: Create or update release
         uses: softprops/action-gh-release@v3
         with:
diff --git a/.github/workflows/move-release-tag.yml b/.github/workflows/move-release-tag.yml
new file mode 100644
index 0000000..9220c33
--- /dev/null
+++ b/.github/workflows/move-release-tag.yml
@@ -0,0 +1,33 @@
+name: Move release tag
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: 'Commit SHA to point `latest` at (defaults to the selected ref)'
+        type: string
+        default: ''
+
+jobs:
+  move-tag:
+    runs-on: self-hosted
+    permissions:
+      contents: write
+    steps:
+      - name: Move latest tag to commit
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const ref = 'tags/latest';
+            const sha = '${{ inputs.commit }}'.trim() || context.sha;
+            try {
+              await github.rest.git.updateRef({
+                ...context.repo, ref, sha, force: true,
+              });
+            } catch (e) {
+              if (e.status !== 422) throw e;
+              await github.rest.git.createRef({
+                ...context.repo, ref: 'refs/tags/latest', sha,
+              });
+            }
+            core.info(`latest -> ${sha}`);