ci: switch to tag-based Docker builds #110

cal · 2026-03-23T15:49:43Z

cal commented

2026-03-23 15:49:43 +00:00

Summary

Adopts the Major Domo "build on tag" CI pattern. Docker images are now built only when a CalVer tag is pushed — no more builds on PRs or branch pushes.

Changes

Workflow trigger: push.tags: ['20*'] only (removes branch push + PR triggers)
Version extraction: inline from tag ref (removes calver, docker-tags, gitea-tag reusable actions)
Docker tags: <version> + production (removes dev/rc/stable channel logic)
Build cache: kept as-is
CLAUDE.md: updated versioning and CI/CD sections

How to release

git tag 2026.3.42
git push origin 2026.3.42

What's removed

Auto-CalVer generation on merge
Multi-channel tag resolution
next-release branch triggers
PR Docker builds (throwaway images)

Unchanged

ruff-lint.yml — still runs on PRs as a quality gate

## Summary Adopts the Major Domo "build on tag" CI pattern. Docker images are now built only when a CalVer tag is pushed — no more builds on PRs or branch pushes. ### Changes - **Workflow trigger**: `push.tags: ['20*']` only (removes branch push + PR triggers) - **Version extraction**: inline from tag ref (removes `calver`, `docker-tags`, `gitea-tag` reusable actions) - **Docker tags**: `<version>` + `production` (removes dev/rc/stable channel logic) - **Build cache**: kept as-is - **CLAUDE.md**: updated versioning and CI/CD sections ### How to release ```bash git tag 2026.3.42 git push origin 2026.3.42 ``` ### What's removed - Auto-CalVer generation on merge - Multi-channel tag resolution - `next-release` branch triggers - PR Docker builds (throwaway images) ### Unchanged - `ruff-lint.yml` — still runs on PRs as a quality gate

cal added 2 commits 2026-03-23 15:49:45 +00:00

ci: switch to tag-based Docker builds fcd2e33916

Replace branch/PR-triggered Docker builds with tag-only triggers.
Images are now built only when a CalVer tag is pushed
(git tag YYYY.M.BUILD && git push origin YYYY.M.BUILD).

- Remove calver, docker-tags, and gitea-tag reusable actions
- Add inline version extraction from tag ref
- Keep existing build cache config
- Update CLAUDE.md versioning and CI/CD sections

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ci: switch to tag-based Docker builds (already committed)

Ruff Lint / lint (pull_request) Successful in 17s

Details

f09470b1f1

Claude added the

ai-reviewing

label 2026-03-23 17:16:48 +00:00

Claude reviewed 2026-03-23 17:17:49 +00:00

Claude left a comment

AI Code Review

Files Reviewed

.gitea/workflows/docker-build.yml (modified)
CLAUDE.md (modified)

Findings

Correctness

VERSION=${GITHUB_REF#refs/tags/} correctly strips the refs/tags/ prefix to yield the bare tag (e.g., 2026.3.42). Standard pattern, no issues.
Docker tags manticorum67/paper-dynasty-discordapp:<version> + production are correct — immutable version tag plus a rolling production pointer that deployment can track.
Build cache kept as-is. No regression.
The failure notification (lines 84–91) omits version, commit_sha, and timestamp params that the success notification includes. When a build fails the version is already extracted (step runs before Docker build), so the info is available. Minor cosmetic gap — failure alerts would benefit from the same context for debugging. Not a blocker since the discord-notify action presumably accepts these as optional.

Security

No issues. GITHUB_REF is a CI-controlled env var — no injection risk. Secrets remain properly referenced via ${{ secrets.* }}.

Style & Conventions

Follows the established Major Domo "build on tag" pattern per CLAUDE.md conventions.
Tag glob '20*' is intentionally broad (matches any tag starting with "20"). Acceptable for an operator-controlled repo — no risk of accidental triggers beyond unusual manual tagging.
CLAUDE.md versioning string updated from YYYY.MM.BUILD to YYYY.M.BUILD (single-digit month), consistent with actual CalVer examples used in commands (2026.3.42). Correct.
Release instructions added as a comment in the CI/CD section of CLAUDE.md — good discoverability.

Suggestions

The failure notification could include version, commit_sha, and timestamp to match the success notification. Useful when debugging a failed build to know exactly which tag triggered it.

Verdict: COMMENT

Clean simplification. Removes reusable action dependencies (calver, docker-tags, gitea-tag) in favour of a single inline version-extraction step. Logic is correct, security is sound, CLAUDE.md updated accurately. Posting as COMMENT since Gitea blocks self-approval.

Automated review by Claude PR Reviewer

## AI Code Review ### Files Reviewed - `.gitea/workflows/docker-build.yml` (modified) - `CLAUDE.md` (modified) ### Findings #### Correctness - `VERSION=${GITHUB_REF#refs/tags/}` correctly strips the `refs/tags/` prefix to yield the bare tag (e.g., `2026.3.42`). Standard pattern, no issues. - Docker tags `manticorum67/paper-dynasty-discordapp:<version>` + `production` are correct — immutable version tag plus a rolling `production` pointer that deployment can track. - Build cache kept as-is. No regression. - The failure notification (lines 84–91) omits `version`, `commit_sha`, and `timestamp` params that the success notification includes. When a build fails the version is already extracted (step runs before Docker build), so the info is available. Minor cosmetic gap — failure alerts would benefit from the same context for debugging. Not a blocker since the `discord-notify` action presumably accepts these as optional. #### Security - No issues. `GITHUB_REF` is a CI-controlled env var — no injection risk. Secrets remain properly referenced via `${{ secrets.* }}`. #### Style & Conventions - Follows the established Major Domo "build on tag" pattern per CLAUDE.md conventions. - Tag glob `'20*'` is intentionally broad (matches any tag starting with "20"). Acceptable for an operator-controlled repo — no risk of accidental triggers beyond unusual manual tagging. - CLAUDE.md versioning string updated from `YYYY.MM.BUILD` to `YYYY.M.BUILD` (single-digit month), consistent with actual CalVer examples used in commands (`2026.3.42`). Correct. - Release instructions added as a comment in the CI/CD section of CLAUDE.md — good discoverability. #### Suggestions - The failure notification could include `version`, `commit_sha`, and `timestamp` to match the success notification. Useful when debugging a failed build to know exactly which tag triggered it. ### Verdict: COMMENT Clean simplification. Removes reusable action dependencies (`calver`, `docker-tags`, `gitea-tag`) in favour of a single inline version-extraction step. Logic is correct, security is sound, CLAUDE.md updated accurately. Posting as COMMENT since Gitea blocks self-approval. --- *Automated review by Claude PR Reviewer*

Claude added

ai-reviewed

and removed

ai-reviewing

labels 2026-03-23 17:18:13 +00:00

cal reviewed 2026-03-23 17:21:17 +00:00

cal left a comment

Reviewed by pd-ops (Claude). Changes are correct and match the Major Domo tag-based CI pattern.

Trigger correctly converted to push.tags: ['20*'] only
Inline version extraction via ${GITHUB_REF#refs/tags/} is clean, removes calver/docker-tags/gitea-tag reusable actions
Docker tags <version> + production correct
Build cache was already present — kept correctly
ruff-lint.yml untouched — correct, lint gate on PRs should remain
Discord notify conditions simplified to unconditional success/failure — appropriate since all tag builds are intentional releases
CLAUDE.md versioning section updated to reflect manual tag workflow

Approved to merge.

Reviewed by pd-ops (Claude). Changes are correct and match the Major Domo tag-based CI pattern. - Trigger correctly converted to `push.tags: ['20*']` only - Inline version extraction via `${GITHUB_REF#refs/tags/}` is clean, removes calver/docker-tags/gitea-tag reusable actions - Docker tags `<version>` + `production` correct - Build cache was already present — kept correctly - ruff-lint.yml untouched — correct, lint gate on PRs should remain - Discord notify conditions simplified to unconditional success/failure — appropriate since all tag builds are intentional releases - CLAUDE.md versioning section updated to reflect manual tag workflow Approved to merge.

Claude approved these changes 2026-03-23 17:21:35 +00:00

Claude left a comment

Reviewed and approved by pd-ops (Claude). Tag-based CI conversion is correct — matches Major Domo pattern, removes calver/docker-tags/gitea-tag reusable actions, keeps build cache and ruff-lint, updates CLAUDE.md.

Claude merged commit f4a57879ab into main

2026-03-23 17:21:59 +00:00

Claude deleted branch ci/tag-based-docker-builds

2026-03-23 17:21:59 +00:00

Claude referenced this issue from a commit

2026-03-23 17:22:01 +00:00

Merge pull request 'ci: switch to tag-based Docker builds' (#110) from ci/tag-based-docker-builds into main

Sign in to join this conversation.

No reviewers