fix(release): publish version tags and Forgejo releases #108

jwilger · 2026-05-06T08:36:57-07:00

jwilger commented

2026-05-06 08:36:57 -07:00

Summary

Promote release Docker images with merge SHA, raw semver version, and latest tags.
Create a Forgejo Release entry pinned to the validated merge SHA with changelog-derived notes and a Docker image link.
Update release tooling tests, operations docs, and threat model for the broadened publish-token scope.

Verification

nix develop --command bash tests/release_tooling_test.sh
nix flake check

Follow-up

Release-candidate image promotion flow tracked in #107.

## Summary - Promote release Docker images with merge SHA, raw semver version, and `latest` tags. - Create a Forgejo Release entry pinned to the validated merge SHA with changelog-derived notes and a Docker image link. - Update release tooling tests, operations docs, and threat model for the broadened publish-token scope. ## Verification - `nix develop --command bash tests/release_tooling_test.sh` - `nix flake check` ## Follow-up - Release-candidate image promotion flow tracked in #107.

jwilger added 1 commit

2026-05-06 08:36:57 -07:00

fix(release): publish version tags and Forgejo releases

CI / Nix flake check (pull_request) Successful in 2m39s

Details

CI / auto_review semantic review (pull_request) Successful in 1s

Details

auto_review auto_review: 3 warnings

Publish release / release-publish (pull_request) Has been skipped

Details

a5e95a16c7

auto-review approved these changes

2026-05-06 08:40:28 -07:00

auto-review left a comment

The PR enhances the release process by promoting Docker images with multiple tags and creating Forgejo Release entries. It updates documentation and tests to reflect these changes. The changes appear safe to merge, but ensure that all new processes are thoroughly tested and documented.

Walkthrough

.forgejo/workflows/release-publish.yml:
- Adds steps to derive the release version from Cargo.toml and promote Docker images with multiple tags.
- Introduces a step to create a Forgejo Release entry with changelog-derived notes.
docs/OPERATIONS.md and docs/THREAT-MODEL.md:
- Updates to reflect the broadened scope of the release publishing token.
tests/release_tooling_test.sh:
- Adds tests to verify the new release process, including version derivation and release note generation.

The PR enhances the release process by promoting Docker images with multiple tags and creating Forgejo Release entries. It updates documentation and tests to reflect these changes. The changes appear safe to merge, but ensure that all new processes are thoroughly tested and documented. ## Walkthrough - **.forgejo/workflows/release-publish.yml**: - Adds steps to derive the release version from `Cargo.toml` and promote Docker images with multiple tags. - Introduces a step to create a Forgejo Release entry with changelog-derived notes. - **docs/OPERATIONS.md** and **docs/THREAT-MODEL.md**: - Updates to reflect the broadened scope of the release publishing token. - **tests/release_tooling_test.sh**: - Adds tests to verify the new release process, including version derivation and release note generation.

.forgejo/workflows/release-publish.yml

🟡 Warning: Ensure that the RELEASE_VERSION is correctly derived from the Cargo.toml file and that the file is present in the expected location. This is crucial for the release process to function correctly.

🟡 **Warning:** Ensure that the `RELEASE_VERSION` is correctly derived from the `Cargo.toml` file and that the file is present in the expected location. This is crucial for the release process to function correctly.

jwilger marked this conversation as resolved

.forgejo/workflows/release-publish.yml

					
				@ -103,3 +118,25 @@ jobs:

				            exit 1

🟡 Warning: Verify that the latest tag is applied correctly and does not overwrite any important existing tags. This can prevent potential issues with versioning and deployment.

🟡 **Warning:** Verify that the `latest` tag is applied correctly and does not overwrite any important existing tags. This can prevent potential issues with versioning and deployment.

🟡 Warning: Ensure that the RELEASE_PUBLISH_TOKEN is securely handled and not exposed in logs or error messages. This is critical for maintaining the security of the release process.

🟡 **Warning:** Ensure that the `RELEASE_PUBLISH_TOKEN` is securely handled and not exposed in logs or error messages. This is critical for maintaining the security of the release process.

jwilger marked this conversation as resolved

jwilger merged commit 32f9cb0e9e into main

2026-05-06 08:47:50 -07:00

jwilger deleted branch fix/release-publish-tags-releases

2026-05-06 08:47:50 -07:00

jwilger referenced this pull request from a commit

2026-05-06 08:47:52 -07:00

fix(release): publish version tags and Forgejo releases (#108)

Sign in to join this conversation.

No reviewers