From b9acc4855cf4d3f6a673bb58374375d80af4630e Mon Sep 17 00:00:00 2001
From: twentyOne2x <contact@attn.market>
Date: Tue, 7 Jul 2026 14:40:23 +0200
Subject: [PATCH] Make GCP artifact publish idempotent (#57)

---
 .github/workflows/gcp-artifact.yml  | 31 ++++++++++++++++++-----------
 tests/test_gcp_artifact_workflow.py |  4 ++++
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/gcp-artifact.yml b/.github/workflows/gcp-artifact.yml
index a512de5..147a6cf 100644
--- a/.github/workflows/gcp-artifact.yml
+++ b/.github/workflows/gcp-artifact.yml
@@ -48,20 +48,27 @@ jobs:
           set -euo pipefail
           tag="${GITHUB_SHA::7}"
           image_uri="${REGION}-docker.pkg.dev/${PROJECT_ID}/${ARTIFACT_REPOSITORY}/${IMAGE_NAME}:${tag}"
+          image_digest="$(gcloud artifacts docker images describe "${image_uri}" --format='value(image_summary.digest)' 2>/dev/null || true)"
 
-          docker build \
-            -f Dockerfile.gcp-staging \
-            --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
-            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
-            --label "livingip.revision=${GITHUB_SHA}" \
-            --label "livingip.surface=teleo-infrastructure" \
-            --label "livingip.tier=gcp-staging" \
-            -t "${image_uri}" \
-            .
+          if [[ -n "${image_digest}" ]]; then
+            echo "Image tag already exists; reusing immutable Artifact Registry image."
+            docker pull "${image_uri}@${image_digest}"
+            docker run --rm "${image_uri}@${image_digest}"
+          else
+            docker build \
+              -f Dockerfile.gcp-staging \
+              --label "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
+              --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
+              --label "livingip.revision=${GITHUB_SHA}" \
+              --label "livingip.surface=teleo-infrastructure" \
+              --label "livingip.tier=gcp-staging" \
+              -t "${image_uri}" \
+              .
 
-          docker run --rm "${image_uri}"
-          docker push "${image_uri}" | tee docker-push.log
-          image_digest="$(awk '/digest: sha256:/ {print $3}' docker-push.log | tail -1)"
+            docker run --rm "${image_uri}"
+            docker push "${image_uri}" | tee docker-push.log
+            image_digest="$(awk '/digest: sha256:/ {print $3}' docker-push.log | tail -1)"
+          fi
           test -n "${image_digest}"
 
           {
diff --git a/tests/test_gcp_artifact_workflow.py b/tests/test_gcp_artifact_workflow.py
index 56b33b5..90f3421 100644
--- a/tests/test_gcp_artifact_workflow.py
+++ b/tests/test_gcp_artifact_workflow.py
@@ -4,6 +4,10 @@ from pathlib import Path
 def test_gcp_artifact_workflow_retains_immutable_image_digest() -> None:
     workflow = Path(".github/workflows/gcp-artifact.yml").read_text()
 
+    assert "gcloud artifacts docker images describe" in workflow
+    assert "Image tag already exists; reusing immutable Artifact Registry image." in workflow
+    assert 'docker pull "${image_uri}@${image_digest}"' in workflow
+    assert 'docker run --rm "${image_uri}@${image_digest}"' in workflow
     assert "docker push" in workflow
     assert "tee docker-push.log" in workflow
     assert "image_digest=" in workflow