Add provenance: false to docker/build-push-action to prevent BuildKit
from generating SLSA attestation entries that appear as unknown/unknown
in the image manifest.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add QEMU emulation and multi-platform build config so ARM64 users
can pull the image without "no matching manifest" errors.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Users pulling the image without authentication get "unauthorized" because
ghcr.io packages default to private under an organization. Add a step in
both release workflows to explicitly set the container package to public.
https://claude.ai/code/session_01QovQeW26KfEEmU1KdFfCPU
Move docker-compose.yml update from release.sh (pre-build) to a
post-release job in both bump.yml and release.yml. This ensures the
image tag in docker-compose only appears on main after the image
exists on ghcr.io, preventing Dokploy from trying to pull a
non-existent image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Update release.sh to also bump docker-compose.yml image tag in the
same commit, keeping the tagged commit in sync
- Add CI and Docker release jobs to bump.yml so it's self-contained
(GITHUB_TOKEN pushes don't trigger other workflows)
- Remove "Pin docker-compose" post-step from release.yml since it's
now handled by release.sh
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add scripts/release.sh that infers bump type from conventional commits
(major/minor/patch), bumps package.json, commits, tags, and pushes.
Includes safety checks for branch, clean tree, and remote sync.
Also adds a workflow_dispatch GitHub Actions workflow (bump.yml) and
Makefile targets (release, release-patch, release-minor, release-major).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
