fix(actions): compute hello world wf

[abcxff]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[abcxff]

• fix(actions): compute hello world wf #5109 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[railway-app]

🚅 Deployed to the rivet-pr-5109 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
frontend-cloud	😴 Sleeping (View Logs)	Web	May 27, 2026 at 2:28 am
website	😴 Sleeping (View Logs)	Web	May 27, 2026 at 2:25 am
frontend-inspector	❌ Build Failed (View Logs)	Web	May 27, 2026 at 2:21 am
ladle	✅ Success (View Logs)	Web	May 27, 2026 at 2:19 am
mcp-hub	✅ Success (View Logs)	Web	May 27, 2026 at 2:17 am
kitchen-sink	❌ Build Failed (View Logs)	Web	May 27, 2026 at 2:17 am

[claude]

Code Review

Overview

This PR conditionally applies the latest Docker tag only on push events, preventing workflow_dispatch runs from overwriting the latest tag. That's a reasonable goal — a manual dispatch on a non-main SHA could incorrectly promote that SHA to latest.

---

Issues

Empty-string tag risk (medium)

tags: |
  rivetdev/compute-hello-world:${{ github.sha }}
  ${{ github.event_name == 'push' && 'rivetdev/compute-hello-world:latest' || '' }}

When triggered by workflow_dispatch, the ternary resolves to '', leaving a blank line in the multiline tag list. docker/build-push-action passes this list directly to docker buildx build --tag, and some versions treat an empty --tag '' as an invalid tag, causing the build step to error out. A safer pattern is to compute the tag list in a prior step:

- name: Compute tags
  id: tags
  run: |
    TAGS="rivetdev/compute-hello-world:${{ github.sha }}"
    if [ "${{ github.event_name }}" = "push" ]; then
      TAGS="$TAGS
rivetdev/compute-hello-world:latest"
    fi
    echo "tags=$TAGS" >> "$GITHUB_OUTPUT"

- name: Build and push
  uses: docker/build-push-action@v4
  with:
    ...
    tags: ${{ steps.tags.outputs.tags }}

workflow_dispatch on main intentionally excluded?

The outer push gate (push: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}) already pushes the image for workflow_dispatch. If someone manually dispatches this workflow on main to re-publish a known-good SHA, they would expect latest to move too. If excluding workflow_dispatch from latest is intentional, a short inline comment explaining why would help future readers.

---

Minor

The PR description template was left unfilled — no summary of the change, no test steps, no checklist. Even a one-liner ("prevent workflow_dispatch from overwriting the latest tag") helps reviewers and makes the git history more useful.

---

Summary

The intent is correct. The main practical risk is the empty-string tag on workflow_dispatch builds — worth testing or switching to the two-step approach above before merging.