Repository navigation
feat(deploy): version-aware image tags — hold :latest on prereleases - #316
Merged
Merged
Conversation
Push the exact v<version> tag (and a floating v<major> on stable releases) alongside sha-<short>. :latest is held while the workspace version is a prerelease — the Docker analog of the npm rc dist-tag — so deployments pulling :latest keep serving the last stable image.
Parent hardening: workflow_dispatch guarded to main/staging; deploy gated on fresh push-triggered CI runs whose commit is still the main tip (gate job); staging gets GHCR parity with its own image namespace (never touches production tags); CI path gating covers bos.app.ts/bos.dev.ts/tsconfig.base.json; check-skills fails loudly on command failure and scopes write permissions; workflow-lint job (actionlint) guards the new reusable workflows. Child reuse: new consumer-ci/consumer-deploy/consumer-staging reusable workflows keyed on a working_directory input; child templates become thin wrappers; release stays local. Jargon (train/leg/skew) removed from workflow files and README; plan 049 records executed decisions and follow-ups.
9 tasks
Group the all-true GITHUB_OUTPUT writes into one redirect block (SC2129) and disable SC2016 on the watchdog where the single-quoted $(date) is intentional — it must expand inside the inner bash on every iteration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bos deploynow pushes the exactv<version>tag alongsidesha-<short>, and a floatingv<major>tag on stable releases.:latestis held while the workspace version is a prerelease - the Docker analog of the npmrcdist-tag - so deployments pullingghcr.io/nearbuilders/everything-dev:latestkeep serving the last stable image.packages/everything-dev/package.jsonin the deploy'sconfigDir(the source the image is built from); child repos without that workspace keep today's sha+latestbehavior.Why now
The changesets version PR (#307) bumps the workspace to
2.0.0-rc.0with majors across the framework packages. Today the image leg only pushessha-<sha>+latest, so merging #307 would move Dockerlatestto the v2 rc image immediately - npm is protected by thercdist-tag but Docker is not. This PR should land before #307 merges.After this PR: merging #307 pushes
sha-<sha>+v2.0.0-rc.0and leaveslateston v1.latestmoves when2.0.0stable ships (which also starts the floatingv2tag).Follow-up plan
I added the workflow audit and centralization plan at:
docs/plans/049-workflow-hardening-and-consumer-reusable-workflows.mdIt captures the agreed next direction:
workflow_dispatch, deploy SHA gating, and staging paritycheck-skillsfailure handlingconsumer-ci,consumer-deploy, andconsumer-stagingworking_directoryinput instead of assuming a flat repo layoutTest plan
pnpm --filter everything-dev exec vitest run tests/unit/image-deploy.test.ts- 14 tests pass (new: prerelease hold, stable major tag, unknown-version fallback,computeImageTagsunits)pnpm run typecheck- all workspaces passpnpm run lint- clean