fix(deploy): use SHA image tag instead of latest in Nomad

Avoids stale image cache issues where Nomad re-uses the old :latest
layer. SHA is injected via nomad -var flag at deploy time.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -40,8 +40,9 @@ jobs:
 
       - name: Deploy to Nomad
         run: |
-          nomad job validate ${SERVICE_NAME}.nomad
-          nomad job run ${SERVICE_NAME}.nomad
+          SHA=$(git rev-parse --short HEAD)
+          nomad job validate -var="image_tag=$SHA" ${SERVICE_NAME}.nomad
+          nomad job run -var="image_tag=$SHA" ${SERVICE_NAME}.nomad
         env:
           NOMAD_ADDR: "https://nomad.i80.dk:4646"
 

citti.nomad

@@ -1,3 +1,8 @@
+variable "image_tag" {
+  type    = string
+  default = "latest"
+}
+
 job "citti" {
   region      = "global"
   datacenters = ["dc1"]
@@ -74,7 +79,7 @@ job "citti" {
       driver = "docker"
 
       config {
-        image      = "registry.i80.dk/gitea/citti:latest"
+        image      = "registry.i80.dk/gitea/citti:${var.image_tag}"
         ports      = ["http"]
         force_pull = true
       }