From 700689e7818bb45865b5261a6044b39e7e8434bf Mon Sep 17 00:00:00 2001
From: Paul Lorenz <paul.lorenz@netfoundry.io>
Date: Wed, 27 May 2026 10:05:45 -0400
Subject: [PATCH] Add optional tag input to promote-downstreams workflow

- adds an optional 'tag' workflow_dispatch input so the promote can be
  dispatched from a branch (e.g. main) while targeting a specific release
  tag, instead of only running against the ref it fires on
- resolves the promoted ref as github.event.inputs.tag || github.ref_name
  in the validate and compare steps, so the release-event path is unchanged
- includes the resolved tag in the concurrency group so promoting different
  tags from a branch no longer cancel each other
---
 .github/workflows/promote-downstreams.yml | 28 +++++++++++++++--------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/promote-downstreams.yml b/.github/workflows/promote-downstreams.yml
index 55052da64..fe9df9393 100644
--- a/.github/workflows/promote-downstreams.yml
+++ b/.github/workflows/promote-downstreams.yml
@@ -1,15 +1,21 @@
 name: Promote Downstream Releases
 
-on: 
-  # may be triggered manually on a release tag that represents a prerelease to promote it to a release in the downstream package repositories and Docker Hub
+on:
+  # may be triggered manually to promote a release tag to stable in the downstream package repositories and Docker Hub.
+  # Dispatch from the tag itself, or from any branch and set the 'tag' input to the release tag to promote.
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to promote, e.g. v2.0.0. Defaults to the ref the run was dispatched from; set this to promote a specific tag when dispatching from a branch.
+        required: false
+        type: string
   # GitHub release is marked stable, i.e., isPrerelease: false
   release:
     types: [released]  # this release event activity type excludes prereleases
 
-# cancel older, redundant runs of same workflow on same branch
+# cancel older, redundant runs of same workflow for the same tag (or dispatched ref)
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
+  group: ${{ github.workflow }}-${{ github.event.inputs.tag || github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
@@ -24,11 +30,14 @@ jobs:
       - name: Validate the Release Tag is a Stable Release Ref
         id: validate
         shell: bash
+        env:
+          # the 'tag' input when dispatched from a branch, otherwise the ref the run fired on (the tag)
+          PROMOTE_REF: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
-          if [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "version=${GITHUB_REF_NAME#v}" | tee -a $GITHUB_OUTPUT
+          if [[ "${PROMOTE_REF}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "version=${PROMOTE_REF#v}" | tee -a $GITHUB_OUTPUT
           else
-            echo "${GITHUB_REF_NAME} is not a semver stable release ref" >&2
+            echo "${PROMOTE_REF} is not a semver stable release ref" >&2
             exit 1
           fi
 
@@ -55,14 +64,15 @@ jobs:
             | sort -V \
             | tail -1
           )
-          CURRENT_VERSION="${GITHUB_REF_NAME}"
-          
+          CURRENT_VERSION="${PROMOTE_REF}"
+
           if [[ "$CURRENT_VERSION" == "$HIGHEST_VERSION" ]]; then
             echo "highest=true" | tee -a $GITHUB_OUTPUT
           else
             echo "highest=false" | tee -a $GITHUB_OUTPUT
           fi
         env:
+          PROMOTE_REF: ${{ github.event.inputs.tag || github.ref_name }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   promote_docker: