check if tag exists before pushing

.github/workflows/ci.yml

@@ -2,15 +2,15 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [ main ]
     paths:
       - ".github/workflows/ci.yml"
       - 'src/**'
       - 'Cargo.*'
       - 'flake.*'
       - 'xtask/**'
   pull_request:
-    branches: [main]
+    branches: [ main ]
     paths:
       - ".github/workflows/ci.yml"
       - 'src/**'
@@ -85,7 +85,7 @@ jobs:
 
   summary:
     runs-on: ubuntu-latest
-    needs: [fmt, clippy, check-versions, test, build]
+    needs: [ fmt, clippy, check-versions, test, build ]
     if: always()
     steps:
       - name: Summary
@@ -186,7 +186,7 @@ jobs:
 
   detect-release:
     runs-on: ubuntu-latest
-    needs: [summary]
+    needs: [ summary ]
     if: |
       github.event_name == 'push' &&
       github.ref == 'refs/heads/main' &&
@@ -212,7 +212,7 @@ jobs:
 
   tag-and-release:
     runs-on: ubuntu-latest
-    needs: [detect-release]
+    needs: [ detect-release ]
     if: needs.detect-release.outputs.is_release == 'true'
     permissions:
       contents: write
@@ -241,10 +241,28 @@ jobs:
         with:
           primary-key: nix-${{ runner.os }}-${{ hashFiles('**/Cargo.lock', 'flake.lock') }}
 
+      - name: Check if image tag already exists
+        id: check-existing
+        env:
+          VERSION: ${{ needs.detect-release.outputs.version }}
+        run: |
+          IMAGE="quay.io/upgrades/k8s-cloud-tagger"
+          TAG="${VERSION}"
+
+          # Check if tag exists (no login needed for public repo)
+          if nix develop -c skopeo inspect "docker://${IMAGE}:${TAG}" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "✅ Image ${IMAGE}:${TAG} already exists - will skip push"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "🚀 Image ${IMAGE}:${TAG} does not exist - will push"
+          fi
+
       - name: Build release image
         run: nix build .#image
 
       - name: Push release image
+        if: steps.check-existing.outputs.exists == 'false'
         id: push
         env:
           VERSION: ${{ needs.detect-release.outputs.version }}
@@ -262,13 +280,34 @@ jobs:
           echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
 
       - name: Summary
+        env:
+          VERSION: ${{ needs.detect-release.outputs.version }}
+          EXISTS: ${{ steps.check-existing.outputs.exists }}
         run: |
-          cat >> "$GITHUB_STEP_SUMMARY" << EOF
-          ## Release ${{ needs.detect-release.outputs.version }}
+          IMAGE="quay.io/upgrades/k8s-cloud-tagger"
+
+          if [[ "$EXISTS" == "true" ]]; then
+            cat >> "$GITHUB_STEP_SUMMARY" << EOF
+          ## Release ${VERSION} ✅
+
+          Image built successfully. Push skipped - version already exists in registry.
 
           | | |
           | --- | --- |
-          | **Image** | \`${{ steps.push.outputs.image }}\` |
-          | **Tag** | \`${{ steps.push.outputs.tag }}\` |
+          | **Image** | \`${IMAGE}\` |
+          | **Tag** | \`${VERSION}\` |
+          | **Status** | Already released |
           | **Registry** | [Quay.io](https://quay.io/repository/upgrades/k8s-cloud-tagger?tab=tags) |
-          EOF
+          EOF
+          else
+            cat >> "$GITHUB_STEP_SUMMARY" << EOF
+          ## Release ${VERSION}
+
+          | | |
+          | --- | --- |
+          | **Image** | \`${IMAGE}\` |
+          | **Tag** | \`${VERSION}\` |
+          | **Status** | Published |
+          | **Registry** | [Quay.io](https://quay.io/repository/upgrades/k8s-cloud-tagger?tab=tags) |
+          EOF
+          fi