Publish Dependabot-orderable release tags from main builds - #41
Merged
Conversation
Main builds that change the image or how it is built (Dockerfile, tool-versions.env, image/, scripts/build-image.sh) now mint a release tag like debian-ghc-9.10.3-build-2026.8.6.347 as a digest-identical re-tag of the sha manifest. Downstream repos pin these and receive bump PRs from Dependabot; sha tags remain for trying branch builds. The build version leads with the date because dependabot-core classifies bare numbers 1000-2999 as a different tag format than 999 and stops proposing updates (dependabot-core#11198). The date is the commit's rather than the wall clock's so that re-running an old main workflow recreates its original tag instead of minting one that sorts above newer releases while pointing at an older image. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds CI support and documentation for publishing Dependabot-friendly “release tags” for the container image, derived from the commit date and workflow run number, so downstream repos can pin stable, orderable tags while still keeping per-commit SHA tags for testing.
Changes:
- Add a
push-release-tagcommand to re-tag the already-published manifest with a date+run-number release tag. - Update the main build workflow to mint release tags only on
mainand only when image-affecting files changed. - Expand README documentation to describe tag types and recommended downstream Dependabot configuration.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
scripts/build-image.sh |
Adds push-release-tag command that mints a commit-date + run-number release tag pointing at the existing manifest. |
README.md |
Documents the tag taxonomy (sha tags, release tags, build cache tags) and downstream pinning/Dependabot guidance. |
.github/workflows/build.yaml |
Fetches full history and conditionally publishes release tags on main only when image-affecting paths changed. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
onslaughtq
marked this pull request as ready for review
August 7, 2026 16:10
qxjit
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Main builds that change the image or how it is built (Dockerfile, tool-versions.env, image/, scripts/build-image.sh) now mint a release tag like debian-ghc-9.10.3-build-2026.8.6.347 as a digest-identical re-tag of the sha manifest. Downstream repos pin these and receive bump PRs from Dependabot; sha tags remain for trying branch builds.
The build version leads with the date because dependabot-core classifies bare numbers 1000-2999 as a different tag format than 999 and stops proposing updates (dependabot-core#11198). The date is the commit's rather than the wall clock's so that re-running an old main workflow recreates its original tag instead of minting one that sorts above newer releases while pointing at an older image.