allow-tags: regexp:^[0-9a-f]{7}$ ensures newest-build strategy compares commit SHA tags, not the stale :latest tag