The kaniko docs used CI_COMMIT_TAG for the docker image tag - but since this variable doesn't exist, the example kaniko config results in always pushing latest.
CI_COMMIT_TAG
latest