Repository navigation
Stop building and pushing container images outside a release #881
Description
What happens
CI Checks (checks.yml) has a publish-container-image job that pushes ghcr.io/cameri/nostream on every push to main:
# .github/workflows/checks.yml:276
publish-container-image:
name: Build and push container image
if: >-
always() && github.event_name == 'push' && github.ref == 'refs/heads/main' &&
…
tags: |
type=raw,value=main
type=sha,prefix=sha-Release (release.yml) pushes the same package on release: [published], which is the one time a published image should exist.
That was deliberate when it landed (#747, 14cca60, 2026-08-30): relay.tnsor.network deploys by pulling ghcr.io/cameri/nostream:main and recreating, so a merge needed a fresh image to deploy. The consequence is that the main tag is a moving pointer to unreleased main rather than a released artifact, and one docker pull ghcr.io/cameri/nostream can hand any consumer code that no release covers.
Requested change
Stop building and pushing outside a release. release.yml stays as the only publisher, and checks.yml builds without pushing (or stops building at all) if a PR-time image is worth keeping for smoke tests.
What has to move first
relay.tnsor.network pulls :main as its deploy mechanism — the server compose references POST /images/create?fromImage=ghcr.io/cameri/nostream&tag=main (containers/nostream-dev-webhook/.scratch/README.md) and the version-check row reads that digest. Removing the push without moving that consumer leaves the box unable to deploy; switching it needs a decision on what it tracks instead (latest release tag, a rolling edge tag built elsewhere, or a digest pinned per release).
Acceptance criteria
- A push to
mainthat publishes no release produces no new image inghcr.io/cameri/nostream. - Publishing a release still produces a tagged image, and
release.ymlis the only job withpackages: write. - Wherever
:mainis documented as a deploy target (containers/nostream-dev-webhook/README.md, the relay deploy runbook), the docs name the released tag instead. -
relay.tnsor.networkhas a deploy path that does not depend on an image built from unreleasedmain.
Evidence
- Run referenced in the request: actions/runs/39084587426, job
117548418140—CI Checks, push tomain, cancelled at 00:55:54Z while the publish job's prerequisites were still running. .github/workflows/checks.yml:276-334— the push,packages: write, and thetype=raw,value=maintag..github/workflows/release.yml:3-5—on: release: types: [published], the intended trigger.
Activity
fix(ci): stop building and pushing container images outside a release (…
avantikonde commentedon Oct 22, 2026
Hi @chappie-daemon , I have prepared a complete fix for this issue on my branch:
avantikonde/nostream@main...avantikonde:nostream:fix/stop-publishing-container-outside-release
It satisfies all acceptance criteria:
publish-container-imagefromchecks.ymland removespackages: writepermissions.release.ymlas the only publisher for officialv*releases.bootstrap.sh, runbooks, and docs to target:latestinstead of:main.publish-container-image.spec.tsand adds a changeset.PRs are currently restricted to collaborators on this repo. Could you either cherry-pick commit
2c977e6or temporarily grant access so I can open the PR? Thanks!chappie-daemon commentedon Oct 23, 2026
Opened #944 carrying your commit
2c977e6— authorship intact (Avanti <avantikonde2020@gmail.com>), change unmodified — plus one follow-up commit for the two acceptance criteria that were still open.Your half is right and I verified it rather than read it: deleting the job and reverting
checks.ymlmakes your test fail withexpected {…} to be undefined, so it genuinely catches the bug. The:main→:latestsweep through the docs and compose stacks is complete, andrelease.ymlis untouched.Two things I added, and one correction to my own first reading:
The tag is now named explicitly in
release.yml. Your diagnosis was right thatrelease.ymlis the intended publisher, but its metadata step had notags:input, solatestcame from the action's default. I checked a real run (the v3.4.1 job log) and the default does emitlatest— so the docs were correct, and I was wrong to flag it as broken. It is still worth pinning, because the deploy path now depends on it, and the spec asserts it.The deploy path.
relay.tnsor.networkpulls through a GitHub webhook that accepted onlypushto the watched branch and asked for tagmain. Removing the push means that path can never see a new image. That fix lives in the webhook stack's own repo, so it is not in this PR — the runbook here records the two host-side steps it needs.Thanks for the thorough write-up; the acceptance criteria were precise enough to check one by one, which is why the remaining gaps were visible at all.
ci(release): publish tags for the releases that actually exist (#881)
avantikonde commentedon Oct 24, 2026
Thanks @chappie-daemon for testing, verifying, and opening the PR with the follow-up additions! Really appreciate the detailed feedback and review.