ci: drive stable Docker/deploy builds off release publish#4484
Conversation
Switch the Stable Docker images and deployment-tag update workflows from the `push: tags` trigger to `release: published`. Previously tags were pushed independently of publishing the release-drafter draft, so the GitHub Release could sit unpublished even though images were already built (e.g. v0.36.28 sat as a draft for days, v0.36.29 was never published). Triggering off `release: published` makes publishing the draft the single source of truth: GitHub creates the tag at the release target commit, which fires both workflows. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
Address review: on release events github.ref_name is ambiguous, so read the tag explicitly from github.event.release.tag_name. Pin the stable-docker checkout to the released tag so the image is built from the exact released commit, and prefer the event tag in the deploy-tag workflow (falling back to releases/latest for manual dispatch). Co-Authored-By: Claude Opus 4.8 <[email protected]>
There was a problem hiding this comment.
Pull request overview
This PR updates the release automation so stable Docker image builds and deployment tag updates are triggered from release: published events instead of push tag events, making “publishing a release” the single source of truth for stable artifacts.
Changes:
- Switch
Stable Docker imagesworkflow trigger frompush: tagstorelease: published, and explicitly build from the release tag. - Switch
Update Deployment tagsworkflow trigger frompush: tagstorelease: publishedwhile keepingworkflow_dispatch, and prefer the release payload’stag_namewhen available.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| .github/workflows/update-docker-compose-stable.yaml | Trigger off release: published and derive latest_tag from the release event (with fallback to releases/latest). |
| .github/workflows/stable-docker.yml | Trigger off release: published and check out/build using the release tag name. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
actions/checkout defaults to github.sha, which on a release event already points at the tagged commit, so the explicit ref is unnecessary. Co-Authored-By: Claude Opus 4.8 <[email protected]>
❌ 2 Tests Failed:
View the top 2 failed test(s) by shortest run time
To view more test analytics, go to the Test Analytics Dashboard |
🔄 Flaky Test DetectedAnalysis: Test_MySQL_BinlogIncident failed with a transient MySQL handshake EOF ("connection was bad") while connecting to a freshly-started testcontainer, an infrastructure/timing flake unrelated to the PR's CI/deploy-config-only changes. ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: TestApiMongo/TestResyncWithSnapshotConfigOnPausedPipe failed on mongo oplog-retention validation (got 23h) because a parallel sibling test (TestMongoDBOplogRetentionValidation) temporarily lowers the server-wide oplogMinRetentionHours to 23, a shared-global-state race between parallel subtests rather than a real bug. ✅ Automatically retrying the workflow |
What
Switch the Stable Docker images and Update Deployment tags workflows from the
push: tagstrigger torelease: published.Why
Tagging and publishing the GitHub Release were decoupled. Tags were pushed independently, so the release-drafter draft could sit unpublished even though Docker images were already built:
v0.36.28sat as a draft for 4 days (images built 06-15, published 06-19).v0.36.29was never published — images built 06-19, draft only published manually on 06-23.Triggering off
release: publishedmakes publishing the draft the single source of truth: GitHub natively creates thevX.Y.Ztag at the release's target commit, which fires both workflows.Notes
stable-docker.ymlneeds no other change —github.ref_nameresolves to the tag name on both event types, soSHA_SHORT: stable-${{ github.ref_name }}still yieldsstable-vX.Y.Zandactions/checkoutchecks out the tag automatically.update-docker-compose-stable.yamlkeepsworkflow_dispatch; itsreleases/latestlookup returns the just-published release.git push origin vX.Y.Zno longer triggers builds — you must publish a release.release: publishedfires on human publishes (the current flow). If release-drafter is later set to auto-publish via the defaultGITHUB_TOKEN, that bot event would not trigger these downstream workflows (GitHub's recursion guard).🤖 Generated with Claude Code