From b321730bc6c63d0fdbca0c3fc10905a9989109d1 Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Fri, 4 Sep 2026 19:03:00 +0530 Subject: [PATCH] ci: allow building a dev image from a branch without cutting a release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Diagnosing the external HTTP/2 failure has required five prereleases (v0.1.6-rc.1 .. rc.5) purely to get an image onto dev, because release.yml only triggers on v* tags and ci.yml builds no image at all. That has two costs beyond the wasted tags: it manufactures real GitHub releases for throwaway diagnostic builds, and the deploy workflow in nudgebee-infra resolves the newest version-shaped tag from GHCR, so every RC becomes eligible for automatic deployment to dev. Adds workflow_dispatch. Dispatched runs publish dev- and dev- and nothing else. Neither matches ^[0-9]+\.[0-9]+\.[0-9]+, so they are invisible to the infra resolver, and the semver patterns stay gated on tag pushes so latest/0.1/0 never move. Two things had to be gated rather than left to run on both event types: - "Verify tag is on main" compares GITHUB_SHA against origin/main, which is the correct policy for a release but would block dispatching from a branch — the entire purpose here. - "Create GitHub release with binaries" uses github.ref_name as the release name with make_latest: true. On a dispatch that is a branch name, so it would publish a release named after the branch and mark it the latest release. Tags come from type=ref/type=sha rather than a raw value because branch names contain "/" (diag/http2-frame-direction), which is not a legal Docker tag; metadata-action sanitises it. --- .github/workflows/release.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3e5b4b2b..372c00f0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,18 @@ on: push: tags: - 'v*' + # Build a throwaway image from any branch, without cutting a release. + # Diagnostic work previously had to push a v* tag for every iteration, which + # created real releases and, because the deploy workflow in nudgebee-infra + # resolves the newest version-shaped tag, made prereleases eligible for + # automatic deployment. Branch builds are tagged dev--, which + # matches neither ^[0-9]+\.[0-9]+\.[0-9]+ nor the semver patterns below, so + # they are invisible to that resolver and never move latest/0.1/0. + # + # type=ref/type=sha are used rather than a raw value because branch names + # contain "/" (diag/http2-frame-direction), which is not legal in a Docker + # tag; metadata-action sanitises it. + workflow_dispatch: env: REGISTRY: ghcr.io @@ -22,6 +34,7 @@ jobs: fetch-depth: 0 - name: Verify tag is on main + if: github.event_name == 'push' run: | git fetch origin main if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then @@ -47,6 +60,8 @@ jobs: type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} + type=ref,event=branch,prefix=dev-,enable=${{ github.event_name == 'workflow_dispatch' }} + type=sha,format=short,prefix=dev-,enable=${{ github.event_name == 'workflow_dispatch' }} - uses: docker/build-push-action@v7 with: @@ -69,6 +84,10 @@ jobs: docker cp arm64:/usr/bin/nudgebee-node-agent /tmp/nudgebee-node-agent-${{ steps.meta.outputs.version }}-arm64 - name: Create GitHub release with binaries + # Only for real tag pushes. On workflow_dispatch github.ref_name is a + # branch, so this would publish a GitHub release named after the branch + # and, with make_latest, mark it as the latest release. + if: github.event_name == 'push' uses: softprops/action-gh-release@v3 with: tag_name: ${{ github.ref_name }}