Auto DevOps doesn't use versioned images

Auto Deploy uses registry tags based on the build ref. e.g. export CI_REGISTRY_TAG="$CI_BUILD_REF_SLUG"

With canaries, if I build the canary, find it flawed, then try to rollback to latest production, it actually just deploys the canary to production.

But even ignoring canary, if I want to rollback to master from two commits ago, I can’t, because master has been overwritten.

In previous templates, I’d push to image:SHA and then also push to image:REF or image:latest for convenience for external users consuming the images, but use the SHA for all deploys.