ci(docker): publish a sortable main-<commit UTC>-<sha7> relay tag

.github/workflows/docker.yml

@@ -16,8 +16,8 @@ name: Docker image
 # the relay image version tracks crates/buzz-relay/Cargo.toml, never desktop.
 #
 # Triggers:
-#   - push to main           → :main + :sha-<7>
-#                              + :debug-main + :debug-sha-<7>
+#   - push to main           → :main + :sha-<7> + :main-<commit UTC>-<7>
+#                              + the matching :debug-* tags
 #   - push tags relay-v*.*.* → :{version} + :{major}.{minor} + :{major}
 #                              + matching :debug-* tags
 #                              (+ :latest/:debug-latest for stable releases)
@@ -34,6 +34,12 @@ name: Docker image
 #   intact) and the bare version flows straight to the semver parser. On a
 #   real push event value= is empty and the match strips relay-v from the ref.
 #
+# :main-<YYYYMMDDHHmmss>-<7> names the same main build as :sha-<7>, prefixed
+# with its UTC commit time so the tag sorts by build order. Kargo's Lexical
+# strategy picks the newest from the tag list alone; :sha-<7> cannot be
+# ordered without fetching every image's metadata. It uses the commit date,
+# not the run date, so a rerun of the same commit re-pushes the same tag.
+#
 # The :latest tag tracks the latest STABLE relay release: metadata-action's
 # `flavor.latest=auto` (its default) emits :latest only for non-prerelease
 # semver, so relay-v0.3.0-rc.1 publishes :0.3.0-rc.1 without moving :latest,
@@ -162,6 +168,7 @@ jobs:
             type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
           labels: |
             org.opencontainers.image.title=Buzz
             org.opencontainers.image.description=WebSocket relay server for the Buzz communications platform
@@ -371,6 +378,7 @@ jobs:
             type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
       - name: Create and push manifest list
         id: manifest

deploy/charts/buzz/README.md

@@ -480,8 +480,8 @@ Every Pod the chart renders — relay, pairing relay, storage accounting, and th
 deletion drain operator job — carries a chart-owned
 `tags.datadoghq.com/version` label derived from the deployed image:
 `image.tag` when set, otherwise `image.digest`, otherwise `Chart.AppVersion`.
-The tag is preferred because it is the readable build name (`sha-<commit>`)
-dashboards already use; promotion tooling writes it together with the digest
+The tag is preferred because it is the readable build name (`sha-<sha7>`, or
+`main-<UTC commit time>-<sha7>` for Kargo-promoted main builds) dashboards use; promotion tooling writes it together with the digest
 that actually pins the image.
 
 ```yaml

scripts/test-release-ref-contract.sh

@@ -52,6 +52,14 @@ fi
 
 grep -q 'verify-release-ref\.sh' "$repo_root/.github/workflows/release.yml"
 grep -q 'verify-release-ref\.sh' "$repo_root/.github/workflows/docker.yml"
+# Kargo's buzz-image warehouse selects Lexical over ^main-[0-9]{14}-[0-9a-f]{7}$;
+# a drifted format stops Freight discovery silently, so pin both image legs.
+sortable_main_tag="            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=\${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}"
+sortable_count="$(grep -Fxc "$sortable_main_tag" "$repo_root/.github/workflows/docker.yml" || true)"
+if [ "$sortable_count" != 2 ]; then
+  echo "docker.yml must publish the sortable main-<UTC>-<sha7> tag on both image legs (found $sortable_count)" >&2
+  exit 1
+fi
 grep -q 'test-release-ref-contract\.sh' "$repo_root/.github/workflows/ci.yml"
 "$repo_root/scripts/test-signed-canary-contract.sh"
 "$repo_root/scripts/test-desktop-release-cache-key.sh"