No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

<@U01BRSYUUDP> we create images using reverse date notation (`yyymmdd_hhmm`) as the image tag and add git metadata as image annotations: <https://github.com/opencontainers/image-spec/blob/main/annotations.md>
We then push the reverse date image tag to our delivery pipelines. I deliberately stay away from a floating tag (like your branch tag) for tracking purposes. We then use this image tag for our observability (<https://docs.datadoghq.com/tracing/deployment_tracking/>)

We do something similar:
1. Images are tagged with the git SHA when built.
2. Release candidates are re-tagged "{SHA}-RC".
3. At deploy time, for each image, we walk back through git history until we find a "{SHA}-RC" tag for that image in the registry.
Steps 1 &amp; 2 don't happen for images that haven't changed (per your problem statement), so the search backwards finds the last RC build.

The only issue here is that you actually need the full git history. This works for us because our Pulumi program is in the same repository that builds our images - but you could apply a similar scheme, like a global build counter you decremented to search.