Add provenance: false to docker/build-push-action to prevent BuildKit
from generating SLSA attestation entries that appear as unknown/unknown
in the image manifest.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add QEMU emulation and multi-platform build config so ARM64 users
can pull the image without "no matching manifest" errors.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Users pulling the image without authentication get "unauthorized" because
ghcr.io packages default to private under an organization. Add a step in
both release workflows to explicitly set the container package to public.
https://claude.ai/code/session_01QovQeW26KfEEmU1KdFfCPU
Move docker-compose.yml update from release.sh (pre-build) to a
post-release job in both bump.yml and release.yml. This ensures the
image tag in docker-compose only appears on main after the image
exists on ghcr.io, preventing Dokploy from trying to pull a
non-existent image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Update release.sh to also bump docker-compose.yml image tag in the
same commit, keeping the tagged commit in sync
- Add CI and Docker release jobs to bump.yml so it's self-contained
(GITHUB_TOKEN pushes don't trigger other workflows)
- Remove "Pin docker-compose" post-step from release.yml since it's
now handled by release.sh
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move docker-compose version pinning from release script to the release
workflow so it runs after the image is pushed to GHCR. Dokploy will
always find the referenced image.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- docker-compose.yml now uses pre-built ghcr.io image instead of build
- ORIGIN is configurable via env var for deployment
- Remove deploy job from release workflow (Dokploy pulls compose from repo)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move the Dokploy webhook into a separate deploy job that depends on
the release job, ensuring the image is fully pushed before redeploying.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace generic registry secrets with ghcr.io using the built-in
GITHUB_TOKEN. Use docker/metadata-action for automatic semver tagging.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
