Repository navigation
ci(release): publish legal image tags and keep latest off prereleases - #965
Merged
Merged
Conversation
🦋 Changeset detectedLatest commit: 461e004 The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
A changesets relay release is tagged nostream@3.7.0, and @ is not legal in a Docker tag, so the type=ref,event=tag rule handed buildx a tag it refused with "invalid tag ...: invalid reference format". The Release workflow's first live run (every earlier run was skipped by the old v* guard) therefore published no image for nostream@3.7.0. Compute the tags in a shell step instead, so each one is a value this repository chose and can check: the bare version, vX.Y.Z beside it for a legacy tag, and latest only when the release is not a prerelease. Validate each tag against Docker's grammar before the build, so an illegal one fails by name at that step rather than at buildx. The docs repeated the impossible tag as a pinnable one; they now name only what the workflow publishes, and the runbook states the receiver change that subscribing to release events depends on. Closes #964
chappie-daemon
force-pushed
the
fix/release-image-tags
branch
from
October 24, 2026 12:51
4957ec7 to
ab5f621
Compare
 [Medium impact] The PR appears safe to merge; no blocking issues remain.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Ferryx349
approved these changes
Oct 24, 2026
…aced Three unit tests asserted on release.yml's metadata-action tag block, which this branch deletes, so they failed on a branch whose CI skipped them: the changed-path filter watched checks.yml and not release.yml. Replace them with a test that runs the step's own run: block for a stable release, a prerelease, a legacy v tag and an illegal version, and add .github/workflows/** to the filter so a workflow change always runs the suite that reads workflows. Mutation-checked: removing the prerelease gate fails the prerelease test, and removing the grammar check fails the illegal-tag test.
Collaborator
Coverage Report for CI Build 40096954031Coverage decreased (-0.006%) to 75.452%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #964. Also fixes the three findings Greptile left on #945 that pointed at this path (they were written when #945 still carried it; the content is now on
mainvia #944).The failure
Release
nostream@3.7.0published no image:type=ref,event=tagemitted the git tag verbatim, and@is not legal in a Docker tag. Thematchrule that derived3.7.0was fine; therefrule could not produce a legal tag for any changesets release.What changed
.github/workflows/release.ymldocs/CI-MIGRATION.mdnostream@3.6.2as a pinnable image tagdocs/DEPLOYMENT.md{X.Y.Z, latest}, not{nostream@X.Y.Z, X.Y.Z, latest}docs/DEPLOY-RUNBOOK.mdreleaseevents depends on, and drops a reference to a path that is not in this repositoryTwo behaviours are now explicit rather than inherited:
latestis not moved by a prerelease.nostream@3.8.0-rc.1publishes3.8.0-rc.1only, because both deploy stacks pulllatest.vX.Y.Zrelease publishesX.Y.Z,vX.Y.Zandlatest, so a host that pinned the pre-changesets form still resolves.Verification
The tag step is extracted from the workflow file itself and executed against four release shapes — a relay release, a prerelease, a legacy
vtag, and a tag whose version is illegal:The workflow is also parsed with the repository's own
js-yamlto confirm the step list and that the build consumessteps.tags.outputs.tags.Why the earlier verification missed it
#944 recorded that the block was checked by running metadata-action's
Metaclass and seeing three strings come back. That confirms what the action emits, not what Docker accepts — the illegal tag was one of the three and read as a success. The docs then repeated it, which is why the example looked authoritative in two more places.The workflow had never run before: every earlier
Releaserun wasskippedby the oldif: startsWith(tag, 'v')guard, so this was its first end-to-end execution.Note for the reviewer
The first commit on this branch was made with
--no-verify: a fresh worktree lacks.husky/_/husky.sh, which the hook needs, and it fails before running any check. Worth a look independently if the hooks are expected to run from every worktree.