fix(release): keep container version selection explicit

[yordis]

• Exact version pins should remain immutable while one conventional default tracks the newest stable release.
• Overlapping major, minor, and stable aliases create update behavior without a supported compatibility policy.
• Prerelease images must remain isolated from the stable default.

[cursor]

PR Summary

Medium Risk
Changes published GHCR tag names and removes semver alias tags, which can break deployments that depended on stable or major/minor tags until they update their image references.

Overview
Stable release publishing no longer pushes overlapping semver aliases (major, major.minor, stable). A tagged stable release still gets the exact version (e.g. 0.0.2) plus a single floating default, latest. Prereleases are unchanged: exact tag plus preview, with no stable default.

A new github-actions:publish-container-test mise task sources publish-container with a mocked docker and asserts the tag/push commands for stable and prerelease refs. The Release Metadata job in common.yml runs that check in CI so tag policy cannot drift silently.

Breaking for image consumers: anything that pulled stable, 1, or 1.2 must switch to an explicit version pin or latest.

^{Reviewed by Cursor Bugbot for commit b4d4381. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: aef4c23e-c75a-43a5-b17a-10d9eb5a8c36

📥 Commits

Reviewing files that changed from the base of the PR and between dd67f1b and b4d4381.

📒 Files selected for processing (3)

• .config/mise/tasks/github-actions/publish-container
• .config/mise/tasks/github-actions/publish-container-test
• .github/workflows/common.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The container publication task now applies version and channel tags only. A Bash test validates stable and prerelease tags with a mocked Docker command. The release workflow runs this test during metadata processing.

Changes

Container publication tags

Layer / File(s)	Summary
Version and channel tag generation .config/mise/tasks/github-actions/publish-container	Stable releases use the version and latest tags. Prerelease releases use the version and preview tags.
Publishing verification and workflow wiring .config/mise/tasks/github-actions/publish-container-test, .github/workflows/common.yml	The test compares mocked Docker commands with expected stable and prerelease sequences. The release-metadata job runs the test task.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to b4d43

Stable releases now publish a shared latest container alias, which can briefly or persistently reference an older release if stable releases publish concurrently. Exact-version consumers remain unaffected, so the PR is mergeable with owner awareness of this bounded release-ordering risk.

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: making container version selection explicit by removing overlapping release aliases.
Description check	✅ Passed	The description directly explains the changeset objectives: immutable exact version pins, one stable default, removal of overlapping aliases, and prerelease isolation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch yordis/fix-release-container-tags

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}