Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 63 additions & 0 deletions .github/workflows/publish-existing-container.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
name: Publish Existing Release Container

on:
workflow_dispatch:
inputs:
tag:
description: Existing semantic-version tag to publish
required: true
default: v1.1.0

permissions:
contents: read
packages: write

jobs:
publish:
name: Publish GHCR image for existing release
runs-on: ubuntu-latest
steps:
- name: Validate requested tag
env:
TAG: ${{ inputs.tag }}
run: |
if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
echo "Tag must match vX.Y.Z: $TAG"
exit 1
fi

- uses: actions/checkout@v7
with:
ref: ${{ inputs.tag }}
fetch-depth: 0

- name: Verify annotated tag and package version
env:
TAG: ${{ inputs.tag }}
run: |
git cat-file -e "${TAG}^{tag}"
version="${TAG#v}"
grep -Fq "version = \"$version\"" pyproject.toml
echo "VERSION=$version" >> "$GITHUB_ENV"

- name: Verify GitHub Release exists
env:
GH_TOKEN: ${{ github.token }}
TAG: ${{ inputs.tag }}
run: gh release view "$TAG" --repo "${{ github.repository }}" >/dev/null

- uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and publish validated container
uses: docker/build-push-action@v6
with:
context: .
push: true
tags: |
ghcr.io/coreyleath-code/helixagent:${{ env.VERSION }}
ghcr.io/coreyleath-code/helixagent:${{ inputs.tag }}
ghcr.io/coreyleath-code/helixagent:latest

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid moving latest during recovery of an older release

When this workflow is dispatched for any older release—especially after the fixed v1.1.0 default becomes stale—it unconditionally overwrites latest with that older image. Clients tracking latest would then be silently downgraded even though a newer release still exists. Either publish only version-specific recovery tags or verify that the requested tag is the repository's newest release before updating latest.

Useful? React with 👍 / 👎.

2 changes: 1 addition & 1 deletion .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ jobs:
- uses: docker/metadata-action@v5
id: meta
with:
images: ghcr.io/${{ github.repository }}
images: ghcr.io/coreyleath-code/helixagent
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
Expand Down
10 changes: 6 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,14 @@

<p align="center">
<a href="https://github.com/CoreyLeath-code/HelixAgent/releases/latest"><img src="https://img.shields.io/github/v/release/CoreyLeath-code/HelixAgent?display_name=tag&sort=semver" alt="Latest release"></a>
<a href="https://github.com/CoreyLeath-code/HelixAgent/pkgs/container/HelixAgent"><img src="https://img.shields.io/badge/GHCR-HelixAgent-2496ED?logo=docker&logoColor=white" alt="GHCR package"></a>
<a href="https://github.com/CoreyLeath-code/HelixAgent/blob/main/LICENSE"><img src="https://img.shields.io/github/license/CoreyLeath-code/HelixAgent" alt="MIT license"></a>
<img src="https://img.shields.io/github/last-commit/CoreyLeath-code/HelixAgent/main" alt="Last commit">
</p>

<p align="center">
<a href="https://github.com/CoreyLeath-code/HelixAgent/actions/workflows/ci-cd.yml"><img src="https://github.com/CoreyLeath-code/HelixAgent/actions/workflows/ci-cd.yml/badge.svg?branch=main" alt="Enterprise CI"></a>
<a href="https://github.com/CoreyLeath-code/HelixAgent/actions/workflows/security.yml"><img src="https://github.com/CoreyLeath-code/HelixAgent/actions/workflows/security.yml/badge.svg?branch=main" alt="Security and supply chain"></a>
<a href="https://github.com/CoreyLeath-code/HelixAgent/actions/workflows/release.yml"><img src="https://github.com/CoreyLeath-code/HelixAgent/actions/workflows/release.yml/badge.svg?branch=main" alt="Release validation"></a>
<a href="https://github.com/CoreyLeath-code/HelixAgent/blob/main/LICENSE"><img src="https://img.shields.io/github/license/CoreyLeath-code/HelixAgent" alt="MIT license"></a>
<img src="https://img.shields.io/github/last-commit/CoreyLeath-code/HelixAgent/main" alt="Last commit">
</p>

<p align="center">
Expand Down Expand Up @@ -298,4 +300,4 @@ docs/ Engineering and deployment notes

HelixAgent is an engineering portfolio project and reference implementation, not a managed commercial AI platform. The repository focuses on modularity, graceful degradation, observable services, automated validation, and secure delivery.

See [Autonomous runtime](docs/AUTONOMY.md), [Security](SECURITY.md), [Contributing](CONTRIBUTING.md), [Changelog](CHANGELOG.md), and [deployment hygiene](docs/L6_DEPLOYMENT_HYGIENE.md).
See [Autonomous runtime](docs/AUTONOMY.md), [Security](SECURITY.md), [Contributing](CONTRIBUTING.md), [Changelog](CHANGELOG.md), and [deployment hygiene](docs/L6_DEPLOYMENT_HYGIENE.md).
Loading