fix: corrected copilot comments

Author: igpetrov

.github/workflows/build-and-test-qa.yml

@@ -38,14 +38,56 @@ env:
   QA_IMAGES: "registry.camunda.cloud/team-cambpm/weblogic14r1 registry.camunda.cloud/team-cambpm/weblogic14r12"
 
 jobs:
+  # Single source of truth: normalize the dispatch inputs ONCE so the build job and the
+  # manifest job can never disagree on the artifact version or the image tag names.
+  # Accepts either "7.24.1 + snapshot=true" or "7.24.1-SNAPSHOT" and produces identical outputs.
+  prepare:
+    runs-on: ubuntu-22.04
+    outputs:
+      version: ${{ steps.norm.outputs.version }}          # canonical version, no suffix (e.g. 7.24.1)
+      snapshot: ${{ steps.norm.outputs.snapshot }}         # "true" | "false"
+      suffix: ${{ steps.norm.outputs.suffix }}             # "SNAPSHOT" | "ee"
+      version_tag: ${{ steps.norm.outputs.version_tag }}   # <version>-<suffix>   (e.g. 7.24.1-ee)
+      latest_tag: ${{ steps.norm.outputs.latest_tag }}     # <major>-latest       (e.g. 7.24-latest)
+      ee_branch: ${{ steps.norm.outputs.ee_branch }}       # qa/docker source branch (e.g. 7.24)
+    steps:
+      - name: Normalize version & snapshot
+        id: norm
+        run: |
+          set -euo pipefail
+          if [ -z "${RAW_VERSION}" ]; then
+            echo "version input must not be empty" >&2; exit 1
+          fi
+          SNAPSHOT="${RAW_SNAPSHOT:-false}"
+          # A "-SNAPSHOT" (or "-ee") suffix on the version is authoritative and implies the flag.
+          case "${RAW_VERSION}" in
+            *-SNAPSHOT) SNAPSHOT=true ;;
+          esac
+          VERSION="${RAW_VERSION%-SNAPSHOT}"
+          VERSION="${VERSION%-ee}"
+          if [ "${SNAPSHOT}" = "true" ]; then SUFFIX=SNAPSHOT; else SUFFIX=ee; fi
+          MAJOR="$(echo "${VERSION}" | cut -d. -f1,2)"   # 7.24.1 -> 7.24
+          {
+            echo "version=${VERSION}"
+            echo "snapshot=${SNAPSHOT}"
+            echo "suffix=${SUFFIX}"
+            echo "version_tag=${VERSION}-${SUFFIX}"
+            echo "latest_tag=${MAJOR}-latest"
+            echo "ee_branch=${MAJOR}"
+          } >> "$GITHUB_OUTPUT"
+        env:
+          RAW_VERSION: ${{ github.event.inputs.version }}
+          RAW_SNAPSHOT: ${{ github.event.inputs.snapshot }}
+
   build-and-test-qa:
+    needs: prepare
     runs-on: ${{ matrix.RUNNER }}
     strategy:
       fail-fast: false
       matrix:
         RUNNER: [ubuntu-22.04, aws-arm-core-4-default]
     steps:
-      - name: Resolve architecture & EE branch
+      - name: Resolve runner architecture
         id: ctx
         run: |
           case "$(uname -m)" in
@@ -54,10 +96,6 @@ jobs:
             *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;;
           esac
           echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
-          # 7.24.1 -> 7.24 ; 7.24.0-SNAPSHOT -> 7.24
-          echo "EE_BRANCH=$(echo "${VERSION}" | cut -d. -f1,2)" >> "$GITHUB_OUTPUT"
-        env:
-          VERSION: ${{ github.event.inputs.version }}
 
       - name: Import Secrets
         id: secrets
@@ -88,7 +126,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: ${{ env.EE_REPO }}
-          ref: ${{ steps.ctx.outputs.EE_BRANCH }}
+          ref: ${{ needs.prepare.outputs.ee_branch }}
           token: ${{ steps.app-token.outputs.token }}
           path: platform-ee
 
@@ -106,7 +144,6 @@ jobs:
           username: ${{ steps.secrets.outputs.HARBOR_USERNAME }}
           password: ${{ steps.secrets.outputs.HARBOR_PASSWORD }}
 
-
       # Nexus-authenticated settings.xml (resolves org.camunda.bpm.weblogic:camunda-bpm-weblogic).
       # Maven interpolates ${env.NEXUS_USR/PSW} at runtime, so no secret is written to disk.
       - name: Generate Maven settings.xml
@@ -127,24 +164,22 @@ jobs:
         working-directory: platform-ee
         run: |
           set -euo pipefail
-          if [ "${SNAPSHOT}" = "true" ]; then SUFFIX=SNAPSHOT; else SUFFIX=ee; fi
-          SRC_TAG="${VERSION}-${SUFFIX}-${ARCH}"
-          echo "Building native ${ARCH} QA images, source tag suffix: ${SRC_TAG}"
+          SRC_TAG="${VERSION_TAG}-${ARCH}"   # e.g. 7.24.1-ee-amd64
+          echo "Building native ${ARCH} QA images, source tag: ${SRC_TAG}"
           ./mvnw -s "${RUNNER_TEMP}/settings.xml" -B -f qa/docker/pom.xml clean install \
             -Pbuild-docker-qa \
-            -Dversion.camunda-bpm="${VERSION}-${SUFFIX}" \
+            -Dversion.camunda-bpm="${VERSION_TAG}" \
             -Dqa.docker.primaryTag="${SRC_TAG}" \
             -Dqa.docker.secondaryTag="${SRC_TAG}" \
             -Ddocker.skip.push=false
         env:
-          VERSION: ${{ github.event.inputs.version }}
-          SNAPSHOT: ${{ github.event.inputs.snapshot }}
+          VERSION_TAG: ${{ needs.prepare.outputs.version_tag }}
           ARCH: ${{ steps.ctx.outputs.ARCH }}
           NEXUS_USR: ${{ steps.secrets.outputs.NEXUS_USER }}
           NEXUS_PSW: ${{ steps.secrets.outputs.NEXUS_PASS }}
 
   create-manifests-qa:
-    needs: build-and-test-qa
+    needs: [prepare, build-and-test-qa]
     runs-on: ubuntu-22.04
     steps:
       - name: Import Secrets
@@ -170,10 +205,8 @@ jobs:
       - name: Create multi-arch manifests
         run: |
           set -euo pipefail
-          if [ "${SNAPSHOT}" = "true" ]; then SUFFIX=SNAPSHOT; else SUFFIX=ee; fi
-          VERSION_TAG="${VERSION}-${SUFFIX}"          # e.g. 7.24.1-ee
-          MAJOR="$(echo "${VERSION}" | cut -d. -f1,2)"
-          LATEST_TAG="${MAJOR}-latest"               # e.g. 7.24-latest (consumed by Portainer)
+          # VERSION_TAG / LATEST_TAG come from the shared `prepare` job, so they are guaranteed
+          # to match the per-arch source tags pushed by build-and-test-qa.
           for image in ${QA_IMAGES}; do
             echo "::group::Manifest ${image}:${VERSION_TAG} / :${LATEST_TAG}"
             docker buildx imagetools create \
@@ -191,6 +224,6 @@ jobs:
             fi
           done
         env:
-          VERSION: ${{ github.event.inputs.version }}
-          SNAPSHOT: ${{ github.event.inputs.snapshot }}
+          VERSION_TAG: ${{ needs.prepare.outputs.version_tag }}
+          LATEST_TAG: ${{ needs.prepare.outputs.latest_tag }}