ci(images): prevent publishing duplicate production versions

Add version checks and concurrency controls to helper and realtime image workflows, with tests covering registry validation.

.github/workflows/coolify-helper.yml

@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-helper"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include:

.github/workflows/coolify-realtime.yml

@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-realtime"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getRealtimeVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include: