fix(ci): deploy PR environments by commit SHA so every push rolls out

Ports bcgov/nr-csp#122 (itself a port of bcgov/quickstart-openshift#2817).

PR images are tagged with the PR number, which is reused on every push.
A repeat push rebuilds the image under the same tag, so oc apply sees an
unchanged Deployment - no pods restart and the stale image keeps serving
despite imagePullPolicy: Always.

Builds now push each image under two tags: the PR number (mutable, still
what merge.yml deploys to test) and the immutable head commit SHA. PR
deploys pass the head SHA as IMAGE_TAG, so every push changes the pod
spec and forces a fresh rollout. Test deploys are unaffected: the
PR-number tag is unique per merge, so the spec changes there anyway.

Author: kamal-mohammed

.github/workflows/pr-open.yml

@@ -38,7 +38,12 @@ jobs:
       - uses: bcgov/action-builder-ghcr@cb2629351c87dd1c2130073e4ebb7233a9653a63 # v4.4.1
         with:
           package: ${{ matrix.package }}
-          tags: ${{ github.event.number }}
+          # The PR tag is mutable (reused every push) and is what merge.yml
+          # deploys/promotes; the head SHA tag is immutable and is what PR
+          # deploys use, so each push changes the pod spec and forces a rollout.
+          tags: |
+            ${{ github.event.number }}
+            ${{ github.event.pull_request.head.sha }}
           tag_fallback: latest
           triggers: ('${{ matrix.package }}/', 'common/', '.github/workflows/')
           build_args: |
@@ -51,6 +56,7 @@ jobs:
     secrets: inherit
     with:
       target: ${{ needs.init.outputs.zone }}
+      tag: ${{ github.event.pull_request.head.sha }}
       triggers: ('backend/', 'frontend/', 'common/', '.github/workflows/')
 
   tests:

backend/openshift.deploy.yml

@@ -13,6 +13,11 @@ parameters:
   - name: IMAGE_TAG
     description: Image tag to use
     required: true
+  # PR deploys pass the immutable head SHA as IMAGE_TAG, so every push changes
+  # the pod spec and forces a rollout (the mutable PR-number tag would leave
+  # `oc apply` seeing an unchanged Deployment and keep serving the stale image
+  # despite imagePullPolicy: Always). Test deploys (merge.yml) use the
+  # PR-number tag, which is unique per merge, so the spec changes there too.
   - name: REGISTRY
     description: Container registry to import from
     value: ghcr.io

frontend/openshift.deploy.yml

@@ -13,6 +13,11 @@ parameters:
   - name: IMAGE_TAG
     description: Image tag to use
     required: true
+  # PR deploys pass the immutable head SHA as IMAGE_TAG, so every push changes
+  # the pod spec and forces a rollout (the mutable PR-number tag would leave
+  # `oc apply` seeing an unchanged Deployment and keep serving the stale image
+  # despite imagePullPolicy: Always). Test deploys (merge.yml) use the
+  # PR-number tag, which is unique per merge, so the spec changes there too.
   - name: REGISTRY
     description: Container registry to import from
     value: ghcr.io