ci(docker): clarify beta image tags

vincentkoc · vincentkoc · commit 3d9f9e710542 · 2026-06-28T11:04:13.000-07:00
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
@@ -14,7 +14,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: Existing release tag to backfill (for example v2026.3.22)
+        description: Existing stable or beta release tag to backfill (for example v2026.3.22 or v2026.3.22-beta.1)
         required: true
         type: string
 
@@ -591,7 +591,8 @@ jobs:
               browser_tags+=("${GHCR_IMAGE}:${version}-browser")
               dockerhub_browser_tags+=("${DOCKERHUB_IMAGE}:${version}-browser")
             fi
-            # Manual backfills should only republish the requested version tags.
+            # Beta releases and manual backfills publish only immutable version tags;
+            # do not advance latest/main aliases from those flows.
             if [[ "${IS_MANUAL_BACKFILL}" != "1" && "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$ ]]; then
               tags+=("${GHCR_IMAGE}:latest" "${GHCR_IMAGE}:main")
               slim_tags+=("${GHCR_IMAGE}:slim" "${GHCR_IMAGE}:main-slim")
@@ -776,6 +777,8 @@ jobs:
               arm64_refs+=("${GHCR_IMAGE}:${version}-browser-arm64")
               dockerhub_arm64_refs+=("${DOCKERHUB_IMAGE}:${version}-browser-arm64")
             fi
+            # Beta releases and manual backfills publish only immutable version tags;
+            # do not advance latest/main aliases from those flows.
             if [[ "${IS_MANUAL_BACKFILL}" != "1" && "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9]+)?$ ]]; then
               multi_refs+=("${GHCR_IMAGE}:latest" "${GHCR_IMAGE}:main")
               slim_multi_refs+=("${GHCR_IMAGE}:slim" "${GHCR_IMAGE}:main-slim")
diff --git a/docs/install/docker.md b/docs/install/docker.md
@@ -54,7 +54,8 @@ Docker is **optional**. Use it only if you want a containerized gateway or to va
     Use `ghcr.io/openclaw/openclaw` or `openclaw/openclaw`. Avoid community
     Docker Hub mirrors because OpenClaw does not control their release timing,
     rebuilds, or retention policy. Common official tags: `main`, `latest`,
-    `<version>` (e.g. `2026.2.26`).
+    `<version>` (e.g. `2026.2.26`), and beta versions such as
+    `2026.2.26-beta.1`. Beta tags do not move `latest` or `main`.
 
   </Step>
 
diff --git a/src/dockerfile.test.ts b/src/dockerfile.test.ts
@@ -366,6 +366,19 @@ describe("Dockerfile", () => {
     expect(workflow).toContain("DOCKERHUB_MULTI_REFS: ${{ steps.refs.outputs.dockerhub_multi }}");
   });
 
+  it("publishes beta Docker tags without advancing latest aliases", async () => {
+    const workflow = await readFile(dockerReleaseWorkflowPath, "utf8");
+
+    expect(workflow).toContain("Existing stable or beta release tag to backfill");
+    expect(workflow).toContain('! "${RELEASE_TAG}" =~ ^v[0-9]{4}');
+    expect(workflow).toContain("(-beta\\.[1-9][0-9]*)?");
+    expect(workflow).toContain("${DOCKERHUB_IMAGE}:${version}");
+    expect(workflow).toContain("${DOCKERHUB_IMAGE}:${version}-slim");
+    expect(workflow).toContain("${DOCKERHUB_IMAGE}:${version}-browser");
+    expect(workflow.split("do not advance latest/main aliases from those flows")).toHaveLength(3);
+    expect(workflow.split('"$version" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9]+)?$')).toHaveLength(3);
+  });
+
   it("smokes runtime workspace templates before Docker release manifests publish", async () => {
     const workflow = await readFile(dockerReleaseWorkflowPath, "utf8");
 
