不使用latest标签

.gitea/workflows/application.yaml

@@ -44,7 +44,7 @@ spec:
         targetPort: http
   template:
     type: stateless
-    image: ${DOCKER_REGISTRY_ADDRESS}/${DOCKER_REPOSITORY_ARTIFACT}:latest
+    image: ${DOCKER_REGISTRY_ADDRESS}/${DOCKER_REPOSITORY_ARTIFACT}:${DOCKER_IMAGE_TAG}
     ports:
       - name: http
         port: 80

.gitea/workflows/mengningsoftware-docs-ci-cd-crd.yaml

@@ -46,6 +46,7 @@ jobs:
         env:
           DOCKER_REGISTRY_ADDRESS: ${{ vars.DOCKER_REGISTRY_ADDRESS }}
           DOCKER_REPOSITORY_ARTIFACT: ${{ vars.DOCKER_REPOSITORY_ARTIFACT }}
+          DOCKER_IMAGE_TAG: ${{ gitea.sha }}
           TLS_CERTIFICATE: ${{ secrets.TLS_CERTIFICATE }}
           TLS_PRIVATE_KEY: ${{ secrets.TLS_PRIVATE_KEY }}
         run: |
@@ -56,7 +57,7 @@ jobs:
           kubectl config set-context remote-context --cluster=remote-cluster --user=token-user
           kubectl config use-context remote-context
 
-          # 创建或更新 TLS Secret（在 istio-system 命名空间）1
+          # 创建或更新 TLS Secret
           # Secret 名称: mengningsoftware-tls
           echo "$TLS_CERTIFICATE" > /tmp/tls.crt
           echo "$TLS_PRIVATE_KEY" > /tmp/tls.key
@@ -68,7 +69,7 @@ jobs:
           rm -f /tmp/tls.crt /tmp/tls.key
 
           # 替换 Application YAML 中的镜像地址变量并应用
-          sed "s|\${DOCKER_REGISTRY_ADDRESS}|${DOCKER_REGISTRY_ADDRESS}|g; s|\${DOCKER_REPOSITORY_ARTIFACT}|${DOCKER_REPOSITORY_ARTIFACT}|g" \
+          sed "s|\${DOCKER_REGISTRY_ADDRESS}|${DOCKER_REGISTRY_ADDRESS}|g; s|\${DOCKER_REPOSITORY_ARTIFACT}|${DOCKER_REPOSITORY_ARTIFACT}|g; s|\${DOCKER_IMAGE_TAG}|${DOCKER_IMAGE_TAG}|g" \
             .gitea/workflows/application.yaml > /tmp/application-crd.yaml
 
           # 删除旧的 Application CRD（如果存在，忽略错误）