Refactor Docker image build workflows into ci/prerelease/release tiers - #14
Merged
Conversation
Replace the duplicated per-variant job bodies in dev.yml/release.yml with a single reusable _build-variant.yml called from a 4-way matrix, and split event handling into three purpose-built workflows: - ci.yml: push/PR, generates all variants and validates with hadolint + `docker buildx build --check` only, no real image build - prerelease.yml (new): v*.*.*-pre.* tags, adds a real multi-platform build (no Docker Hub push) and a GitHub prerelease with notes extracted from docs/Changelog.md - release.yml: v*.*.* tags (excluding -pre.*), adds a Docker Hub push and a full GitHub release Adopts a `v`-prefixed tag convention (v1.1.2, v1.1.2a, v1.1.2a-pre.1) and reuses Ceedling's extract_changelog.sh for changelog-driven release notes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The generated gem install RUN commands target pre-built .gem files whose versions are pinned via Gemfile.lock at image-build time, not a live rubygems.org fetch — hadolint can't see through the glob to know that, so DL3028 fires as a false positive on every variant. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
_build-variant.yml's job requests attestations:write, id-token:write, and packages:write (for the real multi-platform docker build). A reusable workflow's job can't request more permissions than its caller grants, and declaring any permissions: block at all caps everything unlisted at none — so prerelease.yml's contents-only permissions block was silently capping these to none and causing a startup_failure with zero jobs (discovered by actually pushing a v0.0.1-pre.1 tag). ci.yml never hit this because it has no permissions: block and inherits the default token scope. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dev.yml/release.ymlwith a single reusable_build-variant.ymlcalled from a 4-way matrix.ci.yml(push/PR — generate + hadolint +docker buildx build --check, no real image build),prerelease.yml(new —v*.*.*-pre.*tags, real multi-platform build with no Docker Hub push, GitHub prerelease with changelog-extracted notes),release.yml(v*.*.*tags excluding-pre.*— adds Docker Hub push and a full GitHub release).v-prefixed tag convention (v1.1.2,v1.1.2a,v1.1.2a-pre.1) and reuses Ceedling'sextract_changelog.shfor changelog-driven release notes.Test plan
docker buildx build --checkpass locally against all 4 generated Dockerfilesextract_changelog.shverified locally againstdocs/Changelog.mdfor both a found and a not-found versionv1.1.2,v1.1.2a,v1.1.2a-pre.1,v1.1.2-pre.1— exactly one of prerelease/release fires per tagci.ymlruns green on this PR's push + pull_request triggers (validating no real image build occurs)prerelease.ymlruns green against a throwawayv0.0.1-pre.1tag (real multi-platform build, no Docker Hub push, GitHub prerelease created) — to be tested separately, tag will be deleted afterwardrelease.yml's Docker Hub push path is deferred to the next real release tag (not exercised here to avoid touching production:latest)🤖 Generated with Claude Code