[Claudius-Maginificent]

TL;DR: Keep development checks working after the branch rename and ensure published container images contain the software version shown on their labels.

User story

As a Tenderdash maintainer, I want automated checks and published images to use the selected source, so releases can be verified reliably.

Scenario

Base flow

Run development checks after renaming the integration branch, then publish a release or request a container build.

Actual behavior

Some checks try to read the removed branch from the original event. A manually supplied image tag can label a build of different source, and the reported software version can disagree with its label. Older releases can also replace current stable aliases.

Expected behavior

Checks run on the new branch. Image tags, labels and the reported software version identify the selected source. Prereleases, manual builds and older releases preserve current stable aliases.

Detailed discussion

What was done

• Complete the migration to dev: remove obsolete versioned push filters and lint fallback; select the actual push ref or PR base for Super-linter; publish documentation from dev.
• Handle branch-created push events without fetching their deleted base_ref. Enable the relevant jobs directly, including the downstream linter behavior for an all-zero before SHA. Ordinary push/PR diff filtering remains.
• Resolve one validated Docker source/version contract. Manual release tags select that exact existing commit; untagged builds identify the branch and full SHA. Pass the resolved VERSION explicitly through the Dockerfile to Makefile linker flags and OCI labels.
• Publish exact-version images independently. A separate serialized alias job rechecks the current latest release after building and promotes the built digest only for the eligible latest stable version. Any prerelease suffix excludes stable aliases; manual builds do not promote them; a higher stable tag prevents an older line from replacing them. API failures fail closed.
• Declare the stale-maintenance action’s cache, issue and pull-request write permissions explicitly, without repository-contents write. After ci: replace Janitor with native PR concurrency #1592 and this PR merge, repository administrators can safely use read-only default workflow permissions and disable GITHUB_TOKEN pull-request approval; PR Hygiene and the review App retain their explicit scopes.
• Preserve release/manual-only Docker publishing. Add offline contract tests to release-tooling CI and update the canonical release skill/documentation.

The alias job uses GitHub's documented queue: max, retaining pending promotions while exact-version builds remain independent.

Testing

• 14 Docker metadata tests, 40 actual workflow-expression assertions, 12 release-helper tests and local Makefile gates pass.
• Independent reviewer executes stable/prerelease/unreleased version values through the live Go version package and verifies six real metadata CLI cases. Final review has no remaining findings.
• Ruff formatting/checks, ShellCheck, targeted Markdown lint and whitespace checks pass. The stale permission follow-up passes unfiltered actionlint and independent source review of actions/stale v11 cache and issue/PR operations.
• Actionlint 1.7.12 reports only its unsupported official Ubuntu 26.04 label and documented queue: max syntax; exact diagnostics are excluded and independently checked against current GitHub documentation. No other workflow diagnostic remains.
• No image publication, release or secret-bearing workflow dispatch was performed. Full multi-architecture image build and registry behavior await the next authorized publication.

Breaking changes

Manual Docker tag now selects an existing source release tag; it cannot attach an arbitrary version label to unrelated source. Historical source without explicit Docker VERSION support is rejected and requires a separately reviewed legacy publishing path. Tags with SemVer build metadata (+...) are rejected rather than silently translated. There is no runtime or wire-protocol change.

Prior work

• chore(release)!: prepare dev branch and Platform release workflow #1552 defines the dev/stable release workflow and project release skill.
• ci: build and test on Ubuntu 26.04 #1590 and build(docker): use supported Alpine 3.24 bases #1591 provide the current runner and Docker base images.
• Central PR Hygiene branch selection is handled separately in stale_prs_are_bad#117.

Attribution

_{🤖 Co-authored by Claudius the Magnificent AI Agent}

PR Hygiene · f361cfc

• Bots — thepastaclaw ✓
• Self-review — not asked of a bot author
• Build green
• Approvals
  • files with no dedicated owner (.agents/skills/tenderdash-release/SKILL.md, DOCKER/Dockerfile, Makefile and 4 more) — approved by lklimek
  • github (.github/workflows/build.yml, .github/workflows/check-generated.yml, .github/workflows/docker.yml and 11 more) — approved by lklimek

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: dashpay/tenderdash
• Branch: chore/dev-migration-audit
• File: .coderabbit.yaml
• Commit: f361cfc
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 11b61613-644c-4deb-9a3a-2e01ef3e00da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[thepastaclaw]

✅ Final review complete — no blockers (commit f361cfc) · triage: normal

[github-actions]

Waiting for bot review — thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[github-actions]

Waiting for bot review — thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[thepastaclaw]

Final validation — Phase 1 + Phase 2

Static verification of b7a939b confirms one blocking fail-open path in stable-alias promotion. The tag-fetch suggestion is unnecessary because the pinned checkout implementation explicitly fetches all tag refs with fetch-depth: 0, including detached-SHA checkouts. Current build, test, lint, and release-tooling checks pass; PR Hygiene remains pending, and no local builds or tests were run.

🔴 1 blocking

Review provenance

Source: reviewer 1: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: normal by gpt-6.1-sol (effort low) — The cross-cutting CI and Docker release changes introduce meaningful source-selection, versioning, and alias-promotion logic, but do not modify any qualifying critical surface.
• Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer
• Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity quota lookup failed), glm-5.3-flash (not used above high effort; tier asks max)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort high); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `scripts/docker-metadata.py`:
- [BLOCKING] scripts/docker-metadata.py:67: Require an affirmative latest-release match before promoting aliases
  An empty latest-release result currently authorizes promotion instead of preserving existing aliases. The workflow converts a 404 from getLatestRelease into an empty string (.github/workflows/docker.yml:149–154), which satisfies this condition. If the only stable release is deleted or changed to a prerelease while its image builds, the original published-event payload still contains prerelease=false and its Git tag can remain, allowing the withdrawn release to overwrite latest, major, and minor aliases. This contradicts the new fail-closed publication contract. Require latest_release == tag and update scripts/tests/test_docker_metadata.py:91–93 to expect no aliases for an empty result; a first stable release can qualify through its affirmative API tag match.

[github-actions]

Waiting for bot review — thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[github-actions]

Waiting for bot review — thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

[thepastaclaw]

Re-review — Final validation — Phase 1 + Phase 2

Independently reviewed the complete diff at f361cfc and found no remaining actionable defects; the prior fail-open alias-promotion issue is fixed and covered by regression tests. Current CI reports passing build, unit, E2E, lint, documentation, and release-tooling checks, with PR Hygiene still pending. Validation was static-only: no local builds or tests were run, and actual container publication remains unverified.

🔴 0 blocking | 🟡 0 suggestion(s) | 💬 0 nitpick(s)

Review provenance

Source: reviewer 1: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: general); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: normal by gpt-6.1-sol (effort low) — The changes introduce cross-cutting CI and release logic for source selection, version metadata, and serialized Docker alias promotion, but do not modify a qualifying critical surface.
• Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer
• Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity quota lookup failed), glm-5.3-flash (not used above high effort; tier asks max)
• Fresh final gate: an independent Phase-2 review ran after iterative findings were reconciled
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort high); agent phase2-reviewer, gpt-6.1-sol — general (completed, effort high); agent phase2-reviewer

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify the current code and confirm that no unresolved issues remain.

No unresolved findings remain from the prior review on this head.

[github-actions]

Ready for review — files with no dedicated owner: lklimek or shumkov · github: ktechmidas or lklimek or shumkov.
Full checklist in the description.

[github-actions]

Policy satisfied — this can merge.
Full checklist in the description.