CyberCoveLLC/Triple-C
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 47 Wiki Activity

CI: cut releases by hand instead of on every merge to main #79

Merged
jknapp merged 2 commits from ci/release-gate into main 2026-11-14 23:16:38 +00:00
Conversation 0 Commits 2 Files Changed 4
+227 -49
2 Commits
Author SHA1 Message Date
shadowdaoandClaude Opus 5.5 bd0a52269b CI: only main publishes :latest, and only from a tag on main
Secret Scan / scan (pull_request) Successful in 12s
Details
Secret Scan / scan (push) Successful in 5s
Details
Build STT Container / build-stt-container (pull_request) Successful in 2m33s
Details
Build Container / build-container (pull_request) Successful in 18m56s
Details 
A dispatch from another branch, or a v* tag cut on a branch, could otherwise
become the image every user pulls. An older tag on main is still accepted
so a rollback works.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-14 14:56:40 -08:00
shadowdaoandClaude Opus 5.5 8787f39a38 CI: cut releases by hand instead of on every merge to main
Secret Scan / scan (push) Successful in 25s
Details
Secret Scan / scan (pull_request) Successful in 10s
Details
Build Container / build-container (pull_request) Successful in 1m57s
Details
Build STT Container / build-stt-container (pull_request) Successful in 4m12s
Details 
Every merge to main that touched app/ published a signed release, and every
merge touching container/ moved :latest, the image installed apps pull. That
made it impossible to land phased work (the AWS host) on main without
shipping each step.

- build-app.yml runs only on workflow_dispatch. Dispatched on main it
  releases; on any other branch it stays a build/sign/verify dry run.
- Release tags are pinned to the dispatched commit (target_commitish), and
  create-tag now fails if the tag points anywhere else.
- After tagging, the release dispatches build.yml and build-stt.yml with the
  tag. They build that tag and move :latest.
- Pushes to main publish containers as :edge and :<sha> only. The weekly
  security rebuild rebuilds the newest release tag, not main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-11-14 14:55:03 -08:00