From 087edafaeec49f09779cb467d866117ccace6660 Mon Sep 17 00:00:00 2001
From: sebasnallar <sebastiansaidnallar@gmail.com>
Date: Tue, 1 Sep 2026 15:39:56 -0300
Subject: [PATCH] feat(release): publish tag, changelog and OCI annotations on
 the db artifact

Mirrors the release-publish-oci chain: the rds-postgres-db revision now
carries the image tag in its meta and an annotations blob (release-please
notes as the curated changelog + org.opencontainers.image keys).
Annotations are last-write-wins full replacement, so every run sends the
complete set; the release body is truncated at its first '## Artifact'
section so backfill re-runs never feed the appended tables back in. CLI
channel moves alpha-packages -> alpha for the new flags.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3eba2e3..ea79501 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -109,9 +109,27 @@ jobs:
             echo "::error::NP_ARTIFACT_NRN variable is not set"
             exit 1
           fi
-          curl -fsSL https://cli.nullplatform.com/install.sh | VERSION=alpha-packages sh
+          curl -fsSL https://cli.nullplatform.com/install.sh | VERSION=alpha sh
           export PATH="$HOME/.local/bin:$PATH"
 
+          # Annotations are last-write-wins full replacement on the revision, so
+          # every run sends the complete set: the release-please notes as the
+          # curated changelog plus the OCI source/revision/version keys. The
+          # release body is truncated at its first '## Artifact' section so a
+          # backfill re-run never feeds the appended artifact tables back in.
+          EXTRA_ARGS=()
+          RELEASE_BODY=$(gh api "repos/$GITHUB_REPOSITORY/releases/tags/$TAG" --jq '.body // ""' 2>/dev/null || true)
+          printf '%s' "$RELEASE_BODY" | sed '/^## Artifact/,$d' > changelog.md
+          if grep -q '[^[:space:]]' changelog.md; then
+            EXTRA_ARGS+=(--changelog-file changelog.md)
+          fi
+          # The image was built from the tag's commit, not the triggering sha
+          # (they differ on existing_tag backfills).
+          TAG_COMMIT=$(gh api "repos/$GITHUB_REPOSITORY/commits/$TAG" --jq '.sha' 2>/dev/null || true)
+          if [ -n "$TAG_COMMIT" ]; then
+            EXTRA_ARGS+=(--annotation "org.opencontainers.image.revision=$TAG_COMMIT")
+          fi
+
           REG_HOST="${ECR_REGISTRY%%/*}"
           REPOSITORY="${ECR_REGISTRY#*/}/$IMAGE_NAME"
           OUTPUT=$(np artifact create \
@@ -120,6 +138,10 @@ jobs:
             --registry "$REG_HOST" \
             --repository "$REPOSITORY" \
             --digest "$DIGEST" \
+            --tag "$TAG" \
+            --annotation "org.opencontainers.image.source=${{ github.server_url }}/$GITHUB_REPOSITORY" \
+            --annotation "org.opencontainers.image.version=$TAG" \
+            "${EXTRA_ARGS[@]}" \
             --visible-to "organization=*" \
             --format json)
           echo "$OUTPUT"