feat(deploy): version-aware image tags — hold :latest on prereleases

.changeset/version-aware-image-tags.md

@@ -0,0 +1,5 @@
+---
+"everything-dev": minor
+---
+
+Version-aware runtime image tags: `bos deploy` now pushes the exact `v<version>` tag (and a floating `v<major>` tag on stable releases) alongside `sha-<short>`. `:latest` is held while the workspace version is a prerelease — the Docker analog of the npm `rc` dist-tag — so deployments pulling `:latest` keep serving the last stable image until a stable release moves it.

.github/templates/workflows/ci.yml

@@ -1,5 +1,9 @@
 name: CI
 
+# Thin wrapper — the shared implementation lives in the base runtime repo
+# (NEARBuilders/everything-dev). This repo owns triggers, secret policy, and
+# working directory. The @main ref matches the sync trust model: bos sync
+# already tracks the parent's main for all framework-owned files.
 on:
   push:
     branches: [main]
@@ -10,70 +14,13 @@ on:
   pull_request:
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
 jobs:
-  lint-and-typecheck:
-    name: Lint and Type Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Node 24)
-
-      - name: Guard — no stray bun artifacts
-        run: |
-          if [ -f bun.lock ]; then
-            echo "::error::bun.lock present — bun re-migrated the workspace (ADR 0026). Delete bun.lock and re-run pnpm install."
-            exit 1
-          fi
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1.0
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "24"
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Security audit
-        id: audit
-        timeout-minutes: 5
-        env:
-          AUDIT_STRICT: ${{ secrets.AUDIT_STRICT }}
-        run: |
-          set +e -o pipefail
-          timeout 240 pnpm audit --json 2>&1 | tee audit-output.txt
-          audit_exit=$?
-          if [ "$audit_exit" -eq 124 ]; then
-            echo "::warning::pnpm audit timed out after 240s — skipping vulnerability check"
-            exit 0
-          fi
-          if [ "$audit_exit" -gt 1 ]; then
-            echo "::warning::pnpm audit exited with code $audit_exit — see output above"
-            exit 0
-          fi
-          if grep -qiE '(critical|high)' audit-output.txt; then
-            if [ "$AUDIT_STRICT" = "true" ]; then
-              echo "::error::Critical or high vulnerabilities found — failing the audit"
-              exit 1
-            else
-              echo "::warning::Critical or high vulnerabilities found — set AUDIT_STRICT=true secret to fail on these"
-            fi
-          fi
-
-      - name: Run Biome lint and format check
-        run: pnpm exec biome ci .
-
-      - name: Run typecheck
-        run: pnpm run typecheck
-
-      - name: Run tests
-        run: pnpm run test
+  ci:
+    name: CI
+    uses: NEARBuilders/everything-dev/.github/workflows/consumer-ci.yml@main
+    with:
+      working_directory: .
+    secrets: inherit

.github/templates/workflows/deploy.yml

@@ -1,5 +1,9 @@
 name: Deploy
 
+# Thin wrapper — the shared implementation lives in the base runtime repo
+# (NEARBuilders/everything-dev). This repo owns triggers, secret policy, and
+# working directory. The @main ref matches the sync trust model: bos sync
+# already tracks the parent's main for all framework-owned files.
 on:
   workflow_run:
     workflows: [CI]
@@ -12,47 +16,15 @@ on:
         type: boolean
         default: false
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
 permissions:
   contents: read
+  packages: write
 
 jobs:
   deploy:
-    name: Deploy Production
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
-      BOS_STORAGE_API_KEY: ${{ secrets.BOS_STORAGE_API_KEY }}
-      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Node 24)
-        with:
-          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
-
-      - name: Guard — no stray bun artifacts
-        run: |
-          if [ -f bun.lock ]; then
-            echo "::error::bun.lock present — bun re-migrated the workspace (ADR 0026). Delete bun.lock and re-run pnpm install."
-            exit 1
-          fi
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1.0
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "24"
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Deploy (build → upload → publish → image → Railway)
-        timeout-minutes: 25
-        run: pnpm run bos deploy${{ inputs.verbose == true && ' --verbose' || '' }}
+    name: Deploy
+    uses: NEARBuilders/everything-dev/.github/workflows/consumer-deploy.yml@main
+    with:
+      working_directory: .
+      verbose: ${{ inputs.verbose == true }}
+    secrets: inherit

.github/templates/workflows/staging.yml

@@ -1,5 +1,9 @@
 name: Staging
 
+# Thin wrapper — the shared implementation lives in the base runtime repo
+# (NEARBuilders/everything-dev). This repo owns triggers, secret policy, and
+# working directory. The @main ref matches the sync trust model: bos sync
+# already tracks the parent's main for all framework-owned files.
 on:
   push:
     branches:
@@ -11,46 +15,15 @@ on:
         type: boolean
         default: false
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
+  packages: write
 
 jobs:
   deploy-staging:
     name: Deploy Staging
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      NEAR_PRIVATE_KEY: ${{ secrets.NEAR_PRIVATE_KEY }}
-      BOS_STORAGE_API_KEY: ${{ secrets.BOS_STORAGE_API_KEY }}
-      RAILWAY_TOKEN: ${{ secrets.RAILWAY_STAGING_TOKEN }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 (Node 24)
-        with:
-          ref: ${{ github.ref }}
-
-      - name: Guard — no stray bun artifacts
-        run: |
-          if [ -f bun.lock ]; then
-            echo "::error::bun.lock present — bun re-migrated the workspace (ADR 0026). Delete bun.lock and re-run pnpm install."
-            exit 1
-          fi
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@7088e561eb65bb68695d245aa206f005ef30921d # v4.1.0
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "24"
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile --ignore-scripts
-
-      - name: Deploy staging (build → upload → publish → image → Railway)
-        timeout-minutes: 25
-        run: pnpm run bos deploy --env staging${{ inputs.verbose == true && ' --verbose' || '' }}
+    uses: NEARBuilders/everything-dev/.github/workflows/consumer-staging.yml@main
+    with:
+      working_directory: .
+      verbose: ${{ inputs.verbose == true }}
+    secrets: inherit