Prevent overwriting release tags

When building docker images locally, it is possible to accidentally
overwrite a released tag due to improper configuration. This isn't a
good idea because it can cause a lot of confusion when the locally
tagged image is no longer the same as the image that would be pulled
down by from the registry. Prevent this by checking if the tag looks
like a release tag, and erroring out with a helpful messages instead of
overwriting it.

ci/test.py

@@ -377,7 +377,7 @@ def test_local_build(self):
         self.assertPyrexHostCommand('true')
 
     def test_version(self):
-        self.assertRegex(pyrex.VERSION, r'^([0-9]+\.){2}[0-9]+(-.*)?$', msg="Version '%s' is invalid" % pyrex.VERSION)
+        self.assertRegex(pyrex.VERSION, pyrex.VERSION_REGEX, msg="Version '%s' is invalid" % pyrex.VERSION)
 
     def test_version_tag(self):
         tag = None
@@ -395,6 +395,21 @@ def test_version_tag(self):
             self.skipTest('No tag found')
 
         self.assertEqual('v%s' % pyrex.VERSION, tag)
+        self.assertRegex(tag, pyrex.VERSION_TAG_REGEX, msg="Tag '%s' is invalid" % tag)
+
+    @skipIfPrebuilt
+    def test_tag_overwrite(self):
+        # Test that trying to build the image with a release-like tag fails
+        # (and doesn't build the image)
+        conf = self.get_config()
+        conf['config']['pyrextag'] = 'v1.2.3-ci-test'
+        conf.write_conf()
+
+        self.assertPyrexHostCommand('true', returncode=1)
+
+        output = self.assertSubprocess(['docker', 'images', '-q', conf['config']['tag']], capture=True).decode('utf-8').strip()
+        self.assertEqual(output, "", msg="Tagged image found!")
+
 
 class TestImage(PyrexTest):
     def test_tini(self):

pyrex.py

@@ -33,6 +33,9 @@
 
 VERSION = '0.0.1'
 
+VERSION_REGEX = re.compile(r'^([0-9]+\.){2}[0-9]+(-.*)?$')
+VERSION_TAG_REGEX = re.compile(r'^v([0-9]+\.){2}[0-9]+(-.*)?$')
+
 THIS_SCRIPT = os.path.basename(__file__)
 PYREX_CONFVERSION = '1'
 MINIMUM_DOCKER_VERSION = 17
@@ -222,6 +225,12 @@ def build(args):
                 return 1
 
             if config['config']['buildlocal'] == '1':
+                if VERSION_TAG_REGEX.match(config['config']['tag'].split(':')[-1]) is not None:
+                    sys.stderr.write("Image tag '%s' will overwrite release image tag, which is not what you want\n" %
+                            config['config']['tag'])
+                    sys.stderr.write("Try changing 'config:pyrextag' to a different value\n")
+                    return 1
+
                 print("Getting Docker image up to date...")
 
                 docker_args = [docker_path, 'build',