From 290ce3822bf5dab3309bda856757ac87722e4fa8 Mon Sep 17 00:00:00 2001
From: Marko Filipovic <marko.filipovic@caralegal.eu>
Date: Wed, 29 Jul 2026 09:15:50 +0200
Subject: [PATCH] Add weekly scheduled rebuild to refresh rolling
 v{major}-latest Docker tags

---
 .github/workflows/docker-alpine.yml | 20 +++++++++++++++++++-
 .github/workflows/docker-ubuntu.yml | 20 +++++++++++++++++++-
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-alpine.yml b/.github/workflows/docker-alpine.yml
index 7f4d4259c5..333a53fae9 100644
--- a/.github/workflows/docker-alpine.yml
+++ b/.github/workflows/docker-alpine.yml
@@ -10,6 +10,11 @@ on:
       - develop
     tags:
       - 'v**'
+  # Weekly rebuild so the rolling 'v{major}-latest-alpine' tag picks up
+  # base-OS security patches (e.g. Alpine apk package updates) even when no
+  # new Snipe-IT version has been tagged. Does NOT touch immutable vX.Y.Z tags.
+  schedule:
+    - cron: '0 6 * * 1'
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -46,6 +51,17 @@ jobs:
         with:
           persist-credentials: false
 
+      # On a scheduled run there's no tag/branch push event to derive the ref
+      # from, so explicitly check out the most recent published release tag
+      # before building - this is what gets rebuilt to refresh v{major}-latest-alpine.
+      - name: Checkout latest release tag (scheduled runs only)
+        if: github.event_name == 'schedule'
+        run: |
+          git fetch --tags
+          latest_tag=$(git tag -l 'v*' --sort=-v:refname | head -n1)
+          echo "Rebuilding latest release tag: $latest_tag"
+          git checkout "$latest_tag"
+
       # https://github.com/docker/setup-buildx-action
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -69,7 +85,9 @@ jobs:
         uses: docker/metadata-action@v6
         with:
           images: snipe/snipe-it
-          tags: ${{ env.IMAGE_TAGS }}
+          # On schedule, metadata-action can't derive tags from github.ref
+          # (it still points at the default branch) - only emit v{major}-latest-alpine.
+          tags: ${{ github.event_name == 'schedule' && 'type=semver,pattern=v{{major}}-latest-alpine' || env.IMAGE_TAGS }}
           flavor: ${{ env.TAGS_FLAVOR }}
 
       # https://github.com/docker/build-push-action
diff --git a/.github/workflows/docker-ubuntu.yml b/.github/workflows/docker-ubuntu.yml
index ecbf891592..83ad35aea0 100644
--- a/.github/workflows/docker-ubuntu.yml
+++ b/.github/workflows/docker-ubuntu.yml
@@ -10,6 +10,11 @@ on:
       - develop
     tags:
       - 'v**'
+  # Weekly rebuild so the rolling 'v{major}-latest' tag picks up base-OS
+  # security patches (e.g. Ubuntu apt package updates) even when no new
+  # Snipe-IT version has been tagged. Does NOT touch immutable vX.Y.Z tags.
+  schedule:
+    - cron: '0 6 * * 1'
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -46,6 +51,17 @@ jobs:
         with:
           persist-credentials: false
 
+      # On a scheduled run there's no tag/branch push event to derive the ref
+      # from, so explicitly check out the most recent published release tag
+      # before building - this is what gets rebuilt to refresh v{major}-latest.
+      - name: Checkout latest release tag (scheduled runs only)
+        if: github.event_name == 'schedule'
+        run: |
+          git fetch --tags
+          latest_tag=$(git tag -l 'v*' --sort=-v:refname | head -n1)
+          echo "Rebuilding latest release tag: $latest_tag"
+          git checkout "$latest_tag"
+
       # https://github.com/docker/setup-buildx-action
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -69,7 +85,9 @@ jobs:
         uses: docker/metadata-action@v6
         with:
           images: snipe/snipe-it
-          tags: ${{ env.IMAGE_TAGS }}
+          # On schedule, metadata-action can't derive tags from github.ref
+          # (it still points at the default branch) - only emit v{major}-latest.
+          tags: ${{ github.event_name == 'schedule' && 'type=semver,pattern=v{{major}}-latest' || env.IMAGE_TAGS }}
           flavor: ${{ env.TAGS_FLAVOR }}
 
       # https://github.com/docker/build-push-action