ci: add tag-triggered container releases by sozercan · Pull Request #28 · sozercan/agentkit

sozercan · 2026-09-25T22:57:20Z

Summary

Publish the frontend and all three runtime images to GHCR for AMD64 and ARM64 when a version tag is pushed.
Update latest only for stable versions, include SBOM/provenance, and create a GitHub Release with generated notes after all images publish.
Document the release commands. Publishing uses GITHUB_TOKEN; no new secrets are required.

Validation

go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml
go test ./...
make lint
Common Python suite: 930 tests passed in an isolated Python 3.12 environment.
Local, no-push builds of all four images for linux/amd64 and linux/arm64, with SBOM/provenance enabled.
Checked stable/prerelease CLI arguments, workflow dependencies, image names, permissions, and action pins.

No release tag has been pushed or images published as part of this change.

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

chatgpt-codex-connector · 2026-09-25T22:57:29Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-25T22:58:30.735768Z	`2bea56f`	PR opened
🔒 Security Review	⚠️ Failed 2026-09-25T22:58:46.445429Z	`2bea56f`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

Copilot

Copilot review overview

🟡 Changes recommended

Stable SemVer tags containing hyphenated build metadata are incorrectly classified as prereleases.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Hyphenated build metadata is misclassified as a prerelease · New

What changed in this PR

Adds tag-triggered multi-architecture container publishing and GitHub Release creation.

Changes:

Publishes four GHCR images with SBOM and provenance.
Documents stable and prerelease workflows.

File	Description
`.github/workflows/release.yml`	Builds images and creates releases.
`README.md`	Documents release commands and artifacts.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot

Copilot review overview

🟡 Changes recommended

Build-metadata tags can overwrite distinct prerelease image tags.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Prevent collisions when converting SemVer build metadata to image tags · New

Resolved since last review (1)

Hyphenated build metadata is misclassified as a prerelease

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot

Copilot review overview

🟡 Changes recommended

GHCR visibility and non-atomic latest updates could make releases inaccessible or inconsistent.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

Matrix jobs race and inconsistently publish the latest tags · New

Resolved since last review (1)

Prevent collisions when converting SemVer build metadata to image tags

Previously missed (1)

In code that hasn't changed since last review

GHCR packages may remain private after first publication

.github/workflows/release.yml:77

First publication of a personal-account-scoped GHCR package defaults to private. This workflow pushes the four packages but never arranges public visibility, while the README and runtime catalog expose them as pullable defaults; a first release can therefore succeed yet remain unavailable to users. Add the required one-time package-visibility setup to the release procedure (or an automated visibility step) before presenting these as public artifacts.

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot

Copilot review overview

🔵 Needs a closer look

Malformed v-prefixed tags pass validation and trigger publishing jobs without a valid image tag.

Review effort: Balanced
Findings: None

Resolved since last review (1)

Matrix jobs race and inconsistently publish the latest tags

Previously missed (1)

In code that hasn't changed since last review

Validate full SemVer tag format before starting matrix jobs

.github/workflows/release.yml:43

The trigger also matches malformed tags such as v1garbage, but this check rejects only build metadata. The pinned metadata action skips invalid SemVer and emits no version tag, so such a tag cannot be published and starts all four matrix jobs only to fail. Validate the complete vMAJOR.MINOR.PATCH[-PRERELEASE] form here before checkout.

sozercan · 2026-09-26T00:20:44Z

Reviewed the remaining malformed-tag advisory. No second SemVer parser is being added: the pinned docker/metadata-action rejects invalid SemVer and emits no version tag, and Buildx refuses a registry push without a tag. Those image jobs fail, so needs: images prevents release creation. Earlier rejection would improve the error path, but duplicating SemVer parsing is unnecessary for this minimal workflow.

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot

Copilot review overview

🔵 Needs a closer look

The concurrency configuration can cancel pending tagged releases instead of serializing all of them.

Review effort: Balanced
Findings: None

Previously missed (1)

In code that hasn't changed since last review

Prevent pending tag releases from being canceled

.github/workflows/release.yml:13

cancel-in-progress: false protects only the running release. GitHub still keeps a single pending run by default, so if three tags are pushed while the first release is running, the third run cancels the second and that version is never published. Add the larger concurrency queue so tag releases are actually serialized rather than replaced.

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot

Copilot review overview

🟡 Changes recommended

Tag validation can produce inconsistent image names, and failed release creation can allow an older run to roll back latest.

Review effort: Balanced
Findings: 1

Open (1)

Stale version check can roll back a newer release · New

Previously missed (1)

In code that hasn't changed since last review

Incomplete tag validation permits malformed release tags

.github/workflows/release.yml:43

The trigger accepts any tag beginning with v plus a digit, but this guard only rejects +. A valid Git ref such as v1.2.3/foo reaches the workflow; metadata-action normalizes / to - before SemVer validation and publishes v1.2.3-foo, while this script treats the raw tag as stable and later references the nonexistent :v1.2.3/foo. Validate the complete supported tag grammar before any images are published.

+            latest=$(gh api graphql -F owner="${GH_REPO%/*}" -F name="${GH_REPO#*/}" \
+              -f query='query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { latestRelease { tagName } } }' \
+              --jq '.data.repository.latestRelease.tagName // ""')
+            # Older stable releases may publish, but must not roll latest back.
+            if [[ -z "$latest" || "$(printf '%s\n' "$latest" "$TAG" | sort -V | tail -n 1)" == "$TAG" ]]; then


ci: add tag-triggered container releases

2bea56f

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot AI balanced review requested due to automatic review settings September 25, 2026 22:57

Copilot started reviewing on behalf of sozercan September 25, 2026 22:57 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

fix(ci): ignore build metadata in prerelease detection

f7a4c86

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot AI review requested due to automatic review settings September 25, 2026 23:04

Copilot started reviewing on behalf of sozercan September 25, 2026 23:05 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

fix(ci): reject colliding release build metadata

584aba8

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot AI review requested due to automatic review settings September 25, 2026 23:53

Copilot started reviewing on behalf of sozercan September 25, 2026 23:54 View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread .github/workflows/release.yml

fix(ci): promote latest only after all images publish

9c58519

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot AI review requested due to automatic review settings September 26, 2026 00:12

Copilot started reviewing on behalf of sozercan September 26, 2026 00:13 View session

Copilot AI reviewed Sep 26, 2026

View reviewed changes

docs: move release instructions into a dedicated guide

3e1bafa

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot AI review requested due to automatic review settings September 26, 2026 02:38

Copilot started reviewing on behalf of sozercan September 26, 2026 02:39 View session

Copilot AI reviewed Sep 26, 2026

View reviewed changes

docs: align release link with README format

42f05d9

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

Copilot AI review requested due to automatic review settings September 26, 2026 02:43

Copilot started reviewing on behalf of sozercan September 26, 2026 02:43 View session

sozercan merged commit 2fb6efb into main Sep 26, 2026
23 checks passed

sozercan deleted the feat/release-pipeline branch September 26, 2026 02:45

Copilot AI reviewed Sep 26, 2026

View reviewed changes

Navigation Menu

ci: add tag-triggered container releases - #28

ci: add tag-triggered container releases#28
sozercan merged 6 commits into
mainfrom
feat/release-pipeline

sozercan commented Sep 25, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

sozercan commented Sep 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sozercan commented Sep 25, 2026

Summary

Validation

Uh oh!

chatgpt-codex-connector Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

sozercan commented Sep 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chatgpt-codex-connector Bot commented Sep 25, 2026 •

edited

Loading