fix(ci): point latest at the newest release, publish dev builds as edge - #143
Merged
Conversation
`latest` was applied by the dev path, so `docker pull ghcr.io/pelotech/xapi-lrs` returned an unreleased build off main rather than the current release — the opposite of what the tag conventionally promises. Right now it resolves to a build whose org.opencontainers.image.version label reads 6507454, a commit sha, while 0.9.5 sits untagged as far as `latest` is concerned. Moves `latest` onto the release path and republishes dev builds as `edge`. publish-dev also inspected and captured the digest of `:latest` by name, which after this change would have resolved to the RELEASE image — so the dev job would have signed and attested the release build. Those now follow `:edge`. The manifest-list step already applies every tag metadata-action emits, so the release path needed no other change. Documents the three tags in the README, since consumers now have a real contract to rely on: latest = newest release, <version> = immutable, edge = tip of main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ghcr.io/pelotech/xapi-lrs:latestpoints at a dev build, not the newest release:publish-devappliedlateston every non-release push to main, whilepublish-tagonly applied the version tag — sodocker pull ghcr.io/pelotech/xapi-lrsgives you unreleased code. That's the inverse of the convention.Fix
latestmain(unreleased)edgemain<version>The subtle part
publish-devdidn't just setlatest— it also inspected and captured the digest of:latestby name, to sign and attest it:Had I only changed the
tags:inputs, those lookups would have resolved to the release image after this change, and the dev job would have signed and attested a release build. Both now follow:edge.The manifest-list step already applies every tag
metadata-actionemits (jq '.tags | map("-t " + .)'), so the release path needed nothing else.Docs
README now states the contract, since consumers can rely on it:
latest<version>0.9.5(immutable)edgemain— unreleased, moves oftenNothing in the repo depended on the old meaning —
docker-compose.ymlbuilds locally and the README's cosign examples pin explicit versions.Note:
latestonly becomes correct on the next release. If you want 0.9.5 tagged now,crane tag ghcr.io/pelotech/xapi-lrs:0.9.5 latestis safe here — it's a pure retag of an existing digest, so signatures and attestations carry over.