fix(flux): switch pve-nut image policy to numerical run-number ordering

The pve-nut ImagePolicy used `alphabetical desc` over bare 7-char git SHA
tags, which is structurally unsound: SHAs are random hex, so the
"latest" tag is whichever sorts highest by first hex char, not whichever
is newest. With tags [e6e2d9b, 9d5fdfe, 5cde4ad] in ghcr today, the
policy would pick e6e2d9b — the OLDEST commit (Feb 16) — as "latest"
and roll the deploy back, undoing today's SKIP_CAMERAS fix.

Switch the build to emit <run_number>-<short_sha> tags and the policy
to numerical-asc with extract '\$1', matching the pattern already used
by frigate-health-checker. Also add the workflow file to its own
trigger paths so workflow edits rebuild.

The current image tag in job-deploy.yaml (5cde4ad) doesn't match the
new pattern, so the ImagePolicy will hold off updates until the build
triggered by this commit publishes a matching tag.

Refs #187

Author: kumar gopal

.github/workflows/build-pve-nut.yaml

@@ -4,6 +4,7 @@ on:
   push:
     paths:
       - 'scripts/pve-nut/**'
+      - '.github/workflows/build-pve-nut.yaml'
     branches:
       - master
   workflow_dispatch:
@@ -30,21 +31,19 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            # Use only SHA tags for reproducibility - never push 'latest'
-            type=sha,prefix=,format=short
-            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/pve-nut-v') }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/pve-nut-v') }}
+      - name: Set short SHA
+        id: vars
+        run: echo "sha_short=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: scripts/pve-nut
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          # Tag format: <run_number>-<short_sha>. The run_number prefix lets the
+          # Flux ImagePolicy sort numerically (newest build wins) — earlier we
+          # used bare 7-char SHAs with alphabetical-desc, which is unsound for
+          # git SHAs (e.g. 'e6e2d9b' beat '9d5fdfe' purely on first hex char,
+          # making the OLDEST commit "latest"). Matches the pattern used by
+          # frigate-health-checker.
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.run_number }}-${{ steps.vars.outputs.sha_short }}

gitops/clusters/homelab/flux-system/image-automation-pve-nut.yaml

@@ -19,12 +19,14 @@ spec:
   imageRepositoryRef:
     name: pve-nut
   filterTags:
-    # Match only git SHA tags (7 chars) - never use 'latest' for reproducibility
-    pattern: '^[a-f0-9]{7}$'
+    # Match build-sha tags (e.g. 42-abc1234) and extract the build number for
+    # ordering. Alphabetical-desc on bare 7-char SHAs is unsound — see
+    # build-pve-nut.yaml for the rationale.
+    pattern: '^(\d+)-[a-f0-9]{7}$'
+    extract: '$1'
   policy:
-    alphabetical:
-      # Use descending order to get newest SHA (alphabetically later = newer commit)
-      order: desc
+    numerical:
+      order: asc
 ---
 apiVersion: image.toolkit.fluxcd.io/v1beta2
 kind: ImageUpdateAutomation