From ba936424af7d49ee9a72d594ad40c4da5bc537e2 Mon Sep 17 00:00:00 2001
From: Henrik Jess Nielsen <lrihni@egmont.com>
Date: Sat, 6 Jun 2026 01:27:57 +0200
Subject: [PATCH] fix(deploy): use SHA image tag instead of latest in Nomad

Avoids stale image cache issues where Nomad re-uses the old :latest
layer. SHA is injected via nomad -var flag at deploy time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/deploy.yml | 5 +++--
 citti.nomad                 | 7 ++++++-
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 50ede25..6c5fbdc 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -40,8 +40,9 @@ jobs:
 
       - name: Deploy to Nomad
         run: |
-          nomad job validate ${SERVICE_NAME}.nomad
-          nomad job run ${SERVICE_NAME}.nomad
+          SHA=$(git rev-parse --short HEAD)
+          nomad job validate -var="image_tag=$SHA" ${SERVICE_NAME}.nomad
+          nomad job run -var="image_tag=$SHA" ${SERVICE_NAME}.nomad
         env:
           NOMAD_ADDR: "https://nomad.i80.dk:4646"
 
diff --git a/citti.nomad b/citti.nomad
index 836b5ed..4cb2282 100644
--- a/citti.nomad
+++ b/citti.nomad
@@ -1,3 +1,8 @@
+variable "image_tag" {
+  type    = string
+  default = "latest"
+}
+
 job "citti" {
   region      = "global"
   datacenters = ["dc1"]
@@ -74,7 +79,7 @@ job "citti" {
       driver = "docker"
 
       config {
-        image      = "registry.i80.dk/gitea/citti:latest"
+        image      = "registry.i80.dk/gitea/citti:${var.image_tag}"
         ports      = ["http"]
         force_pull = true
       }