From a3d638ba9ed6a2de8b5fe7c3880aceca86c9766a Mon Sep 17 00:00:00 2001
From: Luke Heath <luke@fleetdm.com>
Date: Fri, 26 Jun 2026 15:14:26 -0700
Subject: [PATCH] Fix dogfood-deploy DOCKER_IMAGE guidance (tags + digest) and
 make geolite2 tag digest-safe (#48233)

---
 .github/workflows/dogfood-deploy.yml                   | 2 +-
 infrastructure/dogfood/terraform/aws-tf-module/main.tf | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dogfood-deploy.yml b/.github/workflows/dogfood-deploy.yml
index 35d62efe5d..824e275076 100644
--- a/.github/workflows/dogfood-deploy.yml
+++ b/.github/workflows/dogfood-deploy.yml
@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       DOCKER_IMAGE:
-        description: "The full name of the docker image to be deployed. (e.g. fleetdm/fleet:v4.30.0). Note: do not use fleetdm/fleet:main directly.  Use the short hash instead.  If pull-rate limited, try using the quay.io/fleetdm/fleet mirror."
+        description: "The full image reference to deploy. Usually a tag: an RC branch tag (e.g. fleetdm/fleet:rc-minor-fleet-v4.90.0) or a release tag (e.g. fleetdm/fleet:v4.87.0). To deploy from main, do not use the floating fleetdm/fleet:main tag; pin the immutable digest instead (e.g. fleetdm/fleet@sha256:<digest>, from the main tag on Docker Hub) since per-commit hash tags are no longer published. If pull-rate limited, try the quay.io/fleetdm/fleet mirror."
         required: true
       dry_run:
         description: Dry run only? No "terraform apply"
diff --git a/infrastructure/dogfood/terraform/aws-tf-module/main.tf b/infrastructure/dogfood/terraform/aws-tf-module/main.tf
index ef3245271a..153050d24d 100644
--- a/infrastructure/dogfood/terraform/aws-tf-module/main.tf
+++ b/infrastructure/dogfood/terraform/aws-tf-module/main.tf
@@ -57,7 +57,11 @@ data "aws_caller_identity" "current" {}
 locals {
   customer       = "fleet-dogfood"
   fleet_image    = var.fleet_image # Set this to the version of fleet to be deployed
-  geolite2_image = "${aws_ecr_repository.fleet.repository_url}:${split(":", var.fleet_image)[1]}-geolite2-${formatdate("YYYYMMDDhhmm", timestamp())}"
+  # Tag component for the geolite2 image. Handle both ":tag" and "@sha256:digest" refs
+  # so deploying a digest-pinned image (e.g. from main) yields a clean tag, not a 64-char hex.
+  # For tag refs, take the last ":" segment so registries with a port (host:5000/repo:tag) still resolve to the tag.
+  fleet_image_tag = strcontains(var.fleet_image, "@sha256:") ? "sha256-${substr(split("@sha256:", var.fleet_image)[1], 0, 12)}" : reverse(split(":", var.fleet_image))[0]
+  geolite2_image  = "${aws_ecr_repository.fleet.repository_url}:${local.fleet_image_tag}-geolite2-${formatdate("YYYYMMDDhhmm", timestamp())}"
   extra_environment_variables = {
     FLEET_LICENSE_KEY             = var.fleet_license
     FLEET_LOGGING_DEBUG           = "true"