Gitea's konairius package cleanup rule keeps the most recent version and
counts every tag as a version. Builds that push several tags (build.<ts>,
sha, main, latest) keep only the last-pushed one, so the tag a workload
runs gets deleted: vsftpd kept only `main` and ImagePolicy vsftpd fails
with "version list argument cannot be empty" (#1509); ical-proxy's pinned
main-926ead0 is gone too.
Every konairius image is now pushed with exactly one tag, YYYY-MM-DD-HHMM
(UTC), the scheme review-bot and the gitea_admin images use, and every
consumer follows it through an ImagePolicy instead of a hand-written pin:
- hermes-image.yml: date tag only, no :latest.
- build-ci-images.yml: alpine-jq, cni-plugins, alpine-openssl tag
YYYY-MM-DD-HHMM; the konairius/ and ghcr copies drop :latest.
gitea_admin/ copies are unchanged.
- ImagePolicies for hermes, wiki, shelly-manager, vsftpd switch to the
date filter (alphabetical, accepts YYYY-MM-DD for the older utility
builds). New policies and markers: ical-proxy, mqtt-account-controller,
authentik-samba-bridge-server (HelmRelease tag), the samba-bridge LDAP
outpost, alpine-jq, alpine-openssl, cni-plugins.
- The outpost image moves out of the blueprint string, which Flux setters
cannot patch, into global.env SAMBA_BRIDGE_LDAP_OUTPOST_IMAGE, read by
the blueprint via !Env (same pattern as LDAP_OUTPOST_TLS_* and
AUTHENTIK_GATE_SYNC_TOKEN).
- renovate.json: the new Flux-tracked images join the disabled list.
- Hermes homelab-gitea-pr guide: date tag, one tag, no hand pins.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-botandClaude Opus 5.5