ci(devcontainer-base): validate an explicit candidate tag

Author: robarnold

.github/workflows/image-devcontainer-base.yml

@@ -27,6 +27,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+    env:
+      DEVCONTAINER_BASE_TAG: candidate-${{ github.sha }}
 
     steps:
       - name: Checkout Repo
@@ -37,19 +39,14 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Generate Metadata
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
-        id: metadata
-        with:
-          images: ghcr.io/${{ github.repository_owner }}/devcontainer-base
       - name: Build Candidate Image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: images/devcontainer-base
           file: images/devcontainer-base/Containerfile
           load: true
           push: false
-          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
+          tags: ghcr.io/${{ github.repository_owner }}/devcontainer-base:${{ env.DEVCONTAINER_BASE_TAG }}
       - name: Validate Full CI Pipeline
         uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
         with:
@@ -61,4 +58,8 @@ jobs:
           runCmd: just check-format && just lint && just test
       - name: Push Tested Image
         if: github.event_name != 'pull_request'
-        run: docker push ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
+        run: |
+          docker tag \
+            "ghcr.io/${{ github.repository_owner }}/devcontainer-base:${DEVCONTAINER_BASE_TAG}" \
+            ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest
+          docker push ghcr.io/${{ github.repository_owner }}/devcontainer-base:latest