internal/cli/deploy_image_test.go:70

• After pushing the new commit/tag to origin, the local origin/main remote-tracking ref is not updated unless you fetch. Without a fetch here, latestGitTag (which describes origin/main) can still see the old commit and return v0.1.0 instead of v1.0.0.

	runGit(t, dir, "tag", "v1.0.0")
	runGit(t, dir, "push", "origin", "main", "--tags")

internal/cli/deploy_image_test.go:153

• This test runs with offline = true, so resolveDeployTag won’t fetch before calling latestGitTag. Since latestGitTag now describes origin/main, you need to ensure origin/main is up to date locally; after pushing tags, fetch origin so the remote-tracking ref exists and points at the pushed commit.

	setupGitRepoWithOrigin(t, dir)
	runGit(t, dir, "tag", "v1.2.3")
	runGit(t, dir, "push", "origin", "main", "--tags")

internal/cli/deploy_image.go:33

• The warning message still says "fetch remote tags", but the code now runs git fetch origin (all refs). This makes logs misleading when debugging tag resolution failures.

		if err := gitFetchOrigin(); err != nil {
			logger.L.Warn(fmt.Sprintf("Failed to fetch remote tags: %v", err))
		}

internal/cli/deploy_image_test.go:115

• This test pushes new commits/tags to origin, but refs/remotes/origin/main in the working repo is not updated by git push (only by git fetch). As a result, latestGitTag may return the older tag from the stale origin/main ref, making the test fail or not actually validate “prefers origin”.

	runGit(t, dir, "commit", "-m", "second")
	runGit(t, dir, "tag", "v2.0.0")
	runGit(t, dir, "push", "origin", "main", "--tags")

	origStackDir := stackDir

internal/cli/deploy_image_test.go:267

• The test name still references GitFetchTags, but it now calls gitFetchOrigin(). Renaming the test keeps intent clear and avoids confusion when reading failures.

	err := gitFetchOrigin()

internal/cli/deploy_image.go:48

• This returns a formatted error string but does not wrap the underlying exec error (unlike other helpers in this file that use %w). Wrapping preserves error identity for callers/tests that might want to use errors.Is.

	out, err := cmd.CombinedOutput()
	if err != nil {
		return fmt.Errorf("%s: %s", err, strings.TrimSpace(string(out)))
	}