fix(ci)!: align dev checks and Docker release versions

.agents/skills/tenderdash-release/SKILL.md

@@ -151,9 +151,11 @@ For unsigned/dev releases, state explicitly which binary artifacts are omitted;
 Docker publication remains separate.
 
 Publishing the draft triggers `.github/workflows/docker.yml`. Check that the
-Platform rollout and release request authorize this publication. Stable releases
-currently promote Docker `latest` and the major alias: an older-line security
-release must not run that promotion without a separately approved safe path.
+Platform rollout and release request authorize this publication. Verify exact source
+SHA, binary version and image labels. Stable alias promotion is serialized and
+requires the current latest stable release with no higher stable tag. Prereleases,
+manual runs and older-line releases must not replace stable aliases. Historical
+source without explicit Docker VERSION support needs a separately reviewed path.
 After publication, verify the remote tag SHA, release assets, Docker image tags
 and digests. If asynchronous publishing fails, report the partial state and resume
 only the missing step; do not move tags or repeat a completed release blindly.

.github/workflows/build.yml

@@ -12,9 +12,10 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
+
+# Branch creation/rename events can refer to the deleted old branch.
+env:
+  GIT_DIFF: ${{ github.event_name == 'push' && github.event.created && 'all' || '' }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
@@ -35,6 +36,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             .github/workflows/build.yml
@@ -73,6 +75,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             .github/workflows/build.yml
@@ -105,6 +108,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             .github/workflows/build.yml

.github/workflows/check-generated.yml

@@ -14,13 +14,14 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
 
 permissions:
   contents: read
 
+# Branch creation/rename events can refer to the deleted old branch.
+env:
+  GIT_DIFF: ${{ github.event_name == 'push' && github.event.created && 'all' || '' }}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -32,6 +33,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           # FILES matches bare file names only, so the workflow path goes in
           # PATTERNS (minimatch globs) to re-run the check when it changes.
@@ -74,6 +76,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             **/*.proto

.github/workflows/docker.yml

@@ -7,7 +7,7 @@ on:
     inputs:
       tag:
         type: string
-        description: "Docker tag"
+        description: "Existing release tag to build (empty uses the selected branch/tag)"
         required: false
 
       platforms:
@@ -29,10 +29,30 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-26.04
+    outputs:
+      source_sha: ${{ steps.source.outputs.source_sha }}
+      digest: ${{ steps.docker_build.outputs.digest }}
     env:
       PLATFORMS: ${{ github.event_name == 'release' && 'linux/amd64,linux/arm64' || github.event.inputs.platforms }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Validate Docker publication contract
+        run: python3 -B -m unittest discover -s scripts/tests -p test_docker_metadata.py
+
+      - name: Resolve exact build source and version
+        id: source
+        env:
+          LATEST_RELEASE_TAG: pending
+        run: python3 scripts/docker-metadata.py
+
+      - name: Checkout resolved source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ steps.source.outputs.source_sha }}
+          fetch-depth: 0
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
@@ -49,45 +69,16 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Set suffix to Docker tags
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
-        id: suffix
-        if: ${{ github.event.release != null }}
-        with:
-          result-encoding: string
-          script: "return (context.payload.release.tag_name.includes('-dev') ? '-dev' : '');"
-
-      - name: Determine TENDERMINT_BUILD_OPTIONS
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
-        id: TENDERMINT_BUILD_OPTIONS
-        env:
-          REF_TYPE: ${{ github.ref_type }}
-          REF_NAME: ${{ github.ref_name }}
-        with:
-          result-encoding: string
-          script: |
-            if (process.env.REF_TYPE === 'tag' && !process.env.REF_NAME.includes('-dev')) {
-              return 'tenderdash,stable'
-            }
-            return 'tenderdash,dev'
-
       - name: Set Docker tags and labels
         id: docker_meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6.2.0
         with:
           images: dashpay/tenderdash
-          tags: |
-            type=semver,pattern={{version}},value=${{ github.event.inputs.tag }}
-            type=raw,priority=650,value=${{ github.event.inputs.tag }},enable=${{ github.event.inputs.tag != '' }}
-            type=ref,event=branch
-            type=ref,event=pr
-            type=match,pattern=v(\d+),group=1
-            type=match,pattern=v(\d+.\d+),group=1
-            type=match,pattern=v(\d+.\d+.\d+),group=1
-            type=match,pattern=v(.*),group=1,suffix=,enable=${{ contains(github.event.release.tag_name, '-dev') }}
-          flavor: |
-            latest=${{ github.event.release != null && !contains(github.event.release.tag_name, '-dev') }}
-            suffix=${{ steps.suffix.outputs.result }}
+          tags: ${{ steps.source.outputs.tags }}
+          labels: |
+            org.opencontainers.image.version=${{ steps.source.outputs.version }}
+            org.opencontainers.image.revision=${{ steps.source.outputs.source_sha }}
+          flavor: latest=false
 
       # We build some dependencies and libraries separately. Layers are cached
       # on Docker Hub, as Github caches are not available for other branches.
@@ -105,7 +96,8 @@ jobs:
           cache-to: |
             type=registry,ref=dashpay/tenderdash:buildcache-deps,mode=max
           build-args: |
-            TENDERMINT_BUILD_OPTIONS="${{ steps.TENDERMINT_BUILD_OPTIONS.outputs.result }}"
+            TENDERMINT_BUILD_OPTIONS=${{ steps.source.outputs.build_options }}
+            VERSION=${{ steps.source.outputs.version }}
 
       - name: Publish to Docker Hub
         id: docker_build
@@ -122,6 +114,61 @@ jobs:
             type=registry,ref=dashpay/tenderdash:buildcache-deps
           cache-to: type=gha,mode=max
           build-args: |
-            TENDERMINT_BUILD_OPTIONS="${{ steps.TENDERMINT_BUILD_OPTIONS.outputs.result }}"
+            TENDERMINT_BUILD_OPTIONS=${{ steps.source.outputs.build_options }}
+            VERSION=${{ steps.source.outputs.version }}
       - name: Show Docker image digest
         run: echo ${{ steps.docker_build.outputs.digest }}
+
+  # Serialize alias checks/writes without replacing pending release promotions.
+  promote-aliases:
+    if: github.event_name == 'release'
+    needs: build
+    runs-on: ubuntu-26.04
+    concurrency:
+      group: docker-stable-aliases
+      cancel-in-progress: false
+      queue: max
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ needs.build.outputs.source_sha }}
+          fetch-depth: 0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6  # v4.7.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Read current latest release after building
+        if: github.event_name == 'release'
+        id: latest
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+        with:
+          result-encoding: string
+          script: |
+            try {
+              const {data} = await github.rest.repos.getLatestRelease(context.repo);
+              return data.tag_name;
+            } catch (error) {
+              if (error.status === 404) return '';
+              throw error;
+            }
+
+      - name: Resolve stable aliases
+        if: github.event_name == 'release'
+        id: aliases
+        env:
+          LATEST_RELEASE_TAG: ${{ steps.latest.outputs.result }}
+        run: python3 scripts/docker-metadata.py
+
+      - name: Promote current stable aliases
+        if: github.event_name == 'release' && steps.aliases.outputs.aliases != ''
+        env:
+          ALIASES: ${{ steps.aliases.outputs.aliases }}
+          SOURCE_IMAGE: dashpay/tenderdash@${{ needs.build.outputs.digest }}
+        run: |
+          set --
+          while IFS= read -r alias; do
+            set -- "$@" --tag "dashpay/tenderdash:$alias"
+          done <<< "$ALIASES"
+          docker buildx imagetools create "$@" "$SOURCE_IMAGE"

.github/workflows/docs-deployment.yml

@@ -36,7 +36,7 @@ concurrency:
 
 jobs:
   build:
-    if: github.event_name != 'push' || github.ref_name == github.event.repository.default_branch
+    if: github.event_name != 'push' || github.ref == 'refs/heads/dev'
     name: Build mdBook and RPC documentation
     runs-on: ubuntu-26.04
     steps:
@@ -62,14 +62,14 @@ jobs:
           retention-days: 14
           if-no-files-found: error
       - name: Upload Pages artifact
-        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
+        if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: book/book
 
   deploy:
     name: Deploy to GitHub Pages
-    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch)
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/dev')
     needs: build
     runs-on: ubuntu-slim
     timeout-minutes: 15

.github/workflows/e2e.yml

@@ -9,9 +9,10 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
+
+# Branch creation/rename events can refer to the deleted old branch.
+env:
+  GIT_DIFF: ${{ github.event_name == 'push' && github.event.created && 'all' || '' }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
@@ -37,6 +38,7 @@ jobs:
         with:
           submodules: true
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             .github/workflows/e2e.yml

.github/workflows/govulncheck.yml

@@ -8,9 +8,6 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
 
 permissions:
   contents: read

.github/workflows/lint.yml

@@ -13,9 +13,10 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
+
+# Branch creation/rename events can refer to the deleted old branch.
+env:
+  GIT_DIFF: ${{ github.event_name == 'push' && github.event.created && 'all' || '' }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
@@ -40,6 +41,7 @@ jobs:
           fetch-depth: 0
 
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             .github/workflows/lint.yml
@@ -79,9 +81,10 @@ jobs:
           # which the full-depth checkout above guarantees is present.
           args: >-
             --timeout 10m
-            ${{ github.event_name == 'pull_request' && format('--new-from-rev=origin/{0}', github.base_ref) || '' }}
+            ${{ github.event_name == 'pull_request' && format('--new-from-rev=origin/{0}', github.base_ref) || (github.event.created && '--new-from-rev=HEAD') || '' }}
           github-token: ${{ secrets.github_token }}
           # The action refuses --new-* args while only-new-issues is set, so the
           # two are mutually exclusive: pull requests filter via --new-from-rev
-          # above, and pushes keep the action's own filtering.
-          only-new-issues: ${{ github.event_name != 'pull_request' }}
+          # above. A new branch has no before commit, so its baseline is HEAD;
+          # ordinary pushes keep the action's own filtering.
+          only-new-issues: ${{ github.event_name != 'pull_request' && !github.event.created }}

.github/workflows/markdown-links.yml

@@ -10,16 +10,18 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
+
+# Branch creation/rename events can refer to the deleted old branch.
+env:
+  GIT_DIFF: ${{ github.event_name == 'push' && github.event.created && 'all' || '' }}
 
 jobs:
   markdown-link-check:
     runs-on: ubuntu-26.04
     steps:
       - uses: actions/checkout@v7
       - uses: technote-space/get-diff-action@v6
+        if: github.event_name != 'push' || !github.event.created
         with:
           PATTERNS: |
             **/**.md

.github/workflows/markdown-linter.yml

@@ -9,9 +9,6 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
 
 permissions:
   contents: read
@@ -40,7 +37,7 @@ jobs:
         uses: super-linter/super-linter@2da136927bd4a73596db63044b504547c62cb854 # v9.0.0
         env:
           VALIDATE_ALL_CODEBASE: true
-          DEFAULT_BRANCH: ${{ github.base_ref || github.event.repository.default_branch }}
+          DEFAULT_BRANCH: ${{ github.base_ref || github.ref_name }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VALIDATE_MD: true
           VALIDATE_OPENAPI: true

.github/workflows/proto-lint.yml

@@ -11,9 +11,6 @@ on:
     branches:
       - master
       - dev
-      # Keep both names until the integration-branch migration is complete.
-      - v1.8-dev
-      - v1.9-dev
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}