fix(ci): guard CI_COMMIT_TAG against unbound on main pushes

Andrew Dunnrequested to merge
fix/ci-commit-tag-unbound into main

Summary

.image-build template expanded ${CI_COMMIT_TAG#v} without a default. Under set -u, this errors on every main + Containerfile-change pipeline (CI_COMMIT_TAG unset) with:

/usr/bin/bash: line 239: CI_COMMIT_TAG: unbound variable

Five consecutive main pipelines failed without my attention — MR pipelines run only syntax + lint, so the regression hid behind green MR signals.

Tag pipelines were unaffected (CI_COMMIT_TAG is set there), which is why v2.0.0-rc.2 through rc.4 succeeded and pushed signed images.

Fix

Default to empty before applying the v-strip parameter substitution. Mirrors the safe pattern already used in the resolve_tags block.

Impact

  • After merge, the auto-triggered main pipeline will rebuild changed images (this PR touches .gitlab-ci.yml so all 8 image jobs trigger).
  • Confirms or refutes whether main pipeline image-builds work cleanly.
  • :latest tags should appear in the registry for the first time.

Merge request reports