devx/docs/specs/DEVX-159.md

DEVX-159: Fix build_image push-first strategy to avoid losing latest tag

Problem

The push_image function in build_image.py deletes the existing manifest before pushing (Gitea #31964 workaround). When the push fails for other reasons (HTTP 500), the old tag is lost, breaking all CI jobs that use that image.

This caused ci-base:latest to disappear from the registry when build-images run #4104 failed with HTTP 500 on push, after already deleting the old latest manifest.

Approach

Switch to a push-first strategy:

1. Try pushing directly
2. Only if push fails with "already exists" (Gitea #31964), delete the old manifest and retry
3. If push fails for any other reason, the old manifest is preserved

REQ-1: Push first, no pre-emptive delete REQ-2: Delete + retry only on "already exists" error REQ-3: Old manifest preserved on non-already-exists failures REQ-4: 100% test coverage of new logic

Test Plan

• Unit tests for all push paths (success, already-exists retry, non-already-exists failure, retry-also-fails)
• Verify existing tests still pass

Deploy Plan

• Merge to master, build-images workflow uses new push logic on next image rebuild

Rollback Plan

• Revert the merge commit

Acceptance Criteria

• REQ-1: Push first, no pre-emptive delete
• REQ-2: Delete + retry only on "already exists" error
• REQ-3: Old manifest preserved on non-already-exists failures
• REQ-4: 100% test coverage of new logic