Is there a way to fail a

pants publish

command if the image already exists in a registry?

That seems like something better controlled on the registry side. Systems like Artifactory like you set permissions to disallow users overwriting existing content. Depending on the registry you use, similar permission controls might exist.

Ok. I was hoping to catch it a little upstream since Azure ACR and Terraform does not seem to have that option available. Probably will use commit sha or possibly locking the image and tag: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-image-lock