From 215313e9cb239f4a72b7387b9b1b41871fe2f926 Mon Sep 17 00:00:00 2001
From: 0xFEEDC0DE64 <daniel@brunner.ninja>
Date: Mon, 19 Oct 2026 17:31:53 +0200
Subject: [PATCH] Align chart tag with application 2.4.69-8.5.11

---
 .gitea/workflows/container.yml |  5 +++++
 README.md                      | 16 +++++++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml
index 1537761..6e9dcbd 100644
--- a/.gitea/workflows/container.yml
+++ b/.gitea/workflows/container.yml
@@ -128,6 +128,11 @@ jobs:
           test -n "${php_version}"
           version_tag="${apache_version}-${php_version}"
           printf 'VERSION_TAG=%s\n' "${version_tag}" >> "${GITHUB_ENV}"
+          base_tag="$(git describe --tags --abbrev=0 --match 'v[0-9]*')"
+          if [ "${base_tag}" != "v${version_tag}" ]; then
+            echo "Chart base tag ${base_tag} does not match built image ${version_tag}" >&2
+            exit 1
+          fi
           chart_version="$(./scripts/chart-version.sh)"
           printf 'CHART_VERSION=%s\n' "${chart_version}" >> "${GITHUB_ENV}"
 
diff --git a/README.md b/README.md
index 25f65a8..22b6ba6 100644
--- a/README.md
+++ b/README.md
@@ -44,14 +44,20 @@ The chart can create a new RWX PVC when `existingClaim` is empty. Such PVCs
 carry Helm's `keep` resource policy by default as an additional safeguard for
 website content.
 
-Each successful `main` or scheduled image build also publishes a new chart to
-the `feedc0de` Gitea Helm registry. Its `appVersion` is the unique image tag
-built by that same workflow run. Site values do not override the image, so
-updating the Helm repository and upgrading a release selects the image from the
-new chart:
+Each successful `main` push also publishes a new chart to the `feedc0de`
+Gitea Helm registry. Scheduled builds refresh the image tags without
+publishing a chart. The chart's `appVersion` is the unique image tag built by
+the same push. Site values do not override the image, so updating the Helm
+repository and upgrading a release selects the image from the new chart:
 
 ```sh
 helm repo add brunner.ninja https://brunner.ninja/charts
 helm repo update brunner.ninja
 helm upgrade --install example-site brunner.ninja/php-homepage -f values.yaml
 ```
+
+The chart repository tag follows the bundled Apache and PHP versions. The
+current image contains Apache 2.4.69 and PHP 8.5.11, so `v2.4.69-8.5.11`
+publishes chart `2.4.69-8.5.11`; later chart commits append the Git describe
+count and hash. CI checks the built image's versions against the base Git tag
+before publishing a chart.