From 659b8a533c18ef6517f17004ea2cac83b682f88b Mon Sep 17 00:00:00 2001
From: Justin Chan <justin.chan@nethermind.io>
Date: Thu, 22 Jan 2026 18:50:39 +1100
Subject: [PATCH 1/2] refac: add short commit hash as tag for docker build

---
 .github/workflows/node_docker_build.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/node_docker_build.yml b/.github/workflows/node_docker_build.yml
index e31af9a5..fdc0d60d 100644
--- a/.github/workflows/node_docker_build.yml
+++ b/.github/workflows/node_docker_build.yml
@@ -128,12 +128,13 @@ jobs:
       - name: Determine tags to promote
         id: promote-tags
         run: |
+          SHORT_SHA=${GITHUB_SHA:0:7}
           if [[ "${{ github.ref }}" == refs/tags/* ]]; then
             VERSION=${GITHUB_REF#refs/tags/}
             BASE_VERSION=${VERSION%}
-            echo "TAGS=latest $BASE_VERSION" >> $GITHUB_ENV
+            echo "TAGS=latest $BASE_VERSION $SHORT_SHA" >> $GITHUB_ENV
           else
-            echo "TAGS=latest" >> $GITHUB_ENV
+            echo "TAGS=latest $SHORT_SHA" >> $GITHUB_ENV
           fi
 
       - name: Login to Dockerhub registry with ORAS

From ad337fdf295d641a6a1fc37ad56d8125640c9532 Mon Sep 17 00:00:00 2001
From: Justin Chan <justin.chan@nethermind.io>
Date: Thu, 22 Jan 2026 19:15:07 +1100
Subject: [PATCH 2/2] fix: image not found in staging when using commit hash

---
 .github/workflows/node_docker_build.yml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/node_docker_build.yml b/.github/workflows/node_docker_build.yml
index fdc0d60d..e536ddd7 100644
--- a/.github/workflows/node_docker_build.yml
+++ b/.github/workflows/node_docker_build.yml
@@ -119,6 +119,16 @@ jobs:
             ${{ needs.build.outputs.digest-amd64 }} \
             ${{ needs.build.outputs.digest-arm64 }}
 
+      - name: Tag with commit SHA
+        run: |
+          SHORT_SHA="${{ github.sha }}"
+          SHORT_SHA=${SHORT_SHA:0:7}
+          SHA_TAG="sha-${SHORT_SHA}"
+          docker buildx imagetools create \
+            -t ${DOCKER_REGISTRY}/${DOCKER_REPOSITORY_STAGING}:${SHA_TAG} \
+            ${{ needs.build.outputs.digest-amd64 }} \
+            ${{ needs.build.outputs.digest-arm64 }}
+
       - name: Setup ORAS
         uses: oras-project/setup-oras@v1
 
@@ -128,13 +138,14 @@ jobs:
       - name: Determine tags to promote
         id: promote-tags
         run: |
-          SHORT_SHA=${GITHUB_SHA:0:7}
+          SHORT_SHA="${{ github.sha }}"
+          SHORT_SHA=${SHORT_SHA:0:7}
+          SHA_TAG="sha-${SHORT_SHA}"
           if [[ "${{ github.ref }}" == refs/tags/* ]]; then
             VERSION=${GITHUB_REF#refs/tags/}
-            BASE_VERSION=${VERSION%}
-            echo "TAGS=latest $BASE_VERSION $SHORT_SHA" >> $GITHUB_ENV
+            echo "TAGS=$VERSION $SHA_TAG" >> $GITHUB_ENV
           else
-            echo "TAGS=latest $SHORT_SHA" >> $GITHUB_ENV
+            echo "TAGS=latest $SHA_TAG" >> $GITHUB_ENV
           fi
 
       - name: Login to Dockerhub registry with ORAS
@@ -145,12 +156,16 @@ jobs:
 
       - name: Promote to Dockerhub Production
         run: |
+          set -e
           for tag in $TAGS; do
             echo "Current tag: $tag"
             source_image="${DOCKER_REGISTRY}/${DOCKER_REPOSITORY_STAGING}:${tag}"
             prod_image="${DOCKER_PUBLIC_REGISTRY}/${DOCKER_PUBLIC_REPOSITORY}:${tag}"
             echo "Promoting ${source_image} to ${prod_image}"
-            oras cp -r "${source_image}" "${prod_image}"
+            if ! oras cp -r "${source_image}" "${prod_image}"; then
+              echo "Error: Failed to promote tag ${tag}" >&2
+              exit 1
+            fi
           done
 
       - name: Summary