fix(2753): prevent empty Docker tags after cancelled tag jobs (#2754)

Skip downstream workflow paths that require a computed commit tag when the upstream tag job was cancelled, and fail fast if an empty tag still reaches the shared Docker build action. This preserves fallback rebuild behavior after partial tag-only failures while avoiding misleading invalid-tag Docker errors on main.

Made-with: Cursor

.github/actions/docker-build-publish/action.yml

@@ -55,6 +55,14 @@ inputs:
 runs:
   using: 'composite'
   steps:
+    - name: Validate inputs
+      shell: bash
+      run: |
+        if [[ -z "${{ inputs.image_tag }}" ]]; then
+          echo "::error::image_tag is empty — this usually means the upstream version-tag job was cancelled or failed. Failing early to avoid an invalid Docker tag."
+          exit 1
+        fi
+
     - name: Set tags
       id: set-tags
       shell: bash

.github/workflows/all-tools.yml

@@ -84,7 +84,7 @@ jobs:
 
   build-and-publish:
     needs: [changes, store_image_name_and_tags, all-tools-tag-only]
-    if: ${{ always() && (needs.changes.outputs['all-tools'] == 'true' || needs.all-tools-tag-only.result != 'success' || needs.all-tools-tag-only.outputs.image_tagged != 'true') }}
+    if: ${{ always() && needs.store_image_name_and_tags.outputs.commit_tag != '' && (needs.changes.outputs['all-tools'] == 'true' || needs.all-tools-tag-only.result != 'success' || needs.all-tools-tag-only.outputs.image_tagged != 'true') }}
     # ~0.5 mins saved vs small
     runs-on: gha-runner-scale-set-ubuntu-22.04-amd64-med
     env:
@@ -115,10 +115,13 @@ jobs:
       #     platforms: 'arm64,arm'
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 #v3.11.1
-      - name: Show the "version" build argument
+      - name: Validate version tag
         run: |
+          if [[ -z "${{ env.COMMIT_TAG }}" ]]; then
+            echo "::error::COMMIT_TAG is empty — this usually means the upstream version-tag job was cancelled or failed. Failing early to avoid an invalid Docker tag."
+            exit 1
+          fi
           echo "We inject the commit tag in the docker image ${{ env.COMMIT_TAG }}"
-          echo COMMIT_TAG=${{ env.COMMIT_TAG }} >> GITHUB_ENV
       
       - name: "Get Node.js version"
         id: get-node-version

.github/workflows/main.yml

@@ -177,7 +177,7 @@ jobs:
 
   testing:
     needs: [filter-commit-changes, check-and-tag-images]
-    if: ${{ always() && needs.filter-commit-changes.outputs.has-changes-requiring-build == 'true' }}
+    if: ${{ always() && needs.filter-commit-changes.outputs.has-changes-requiring-build == 'true' && needs.check-and-tag-images.outputs.commit_tag != '' }}
     uses: ./.github/workflows/testing.yml
     with:
       commit_tag: ${{ needs.check-and-tag-images.outputs.commit_tag }}
@@ -271,7 +271,7 @@ jobs:
 
   publish-images-after-run-tests-success-on-main:
     needs: [filter-commit-changes, check-and-tag-images, testing, run-e2e-tests, get-has-changes-requiring-e2e-testing]
-    if: ${{ always() && github.ref == 'refs/heads/main' && needs.testing.result == 'success' && (needs.run-e2e-tests.outputs.tests_outcome == 'success' || needs.get-has-changes-requiring-e2e-testing.outputs.has-changes-requiring-e2e-testing == 'false') }}
+    if: ${{ always() && github.ref == 'refs/heads/main' && needs.check-and-tag-images.outputs.commit_tag != '' && needs.testing.result == 'success' && (needs.run-e2e-tests.outputs.tests_outcome == 'success' || needs.get-has-changes-requiring-e2e-testing.outputs.has-changes-requiring-e2e-testing == 'false') }}
     uses: ./.github/workflows/build-and-publish.yml
     with:
       push_image: true