CH-001: Publish container image to GHCR on tagged releases - #17
Merged
Conversation
Seeds the identity ledger (MIG-008) and opens CH-001, proposing to publish a versioned container image so contributors no longer have to build it themselves before running a battle. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hma5K774H256sXrcqshaff
Adds CAP-001 (goal, criteria, design), ADR-001 for the GHCR/tag-trigger/ manual-versioning decision, CHANGELOG.md, RELEASING.md, the publish.yml workflow, and README/architecture updates. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hma5K774H256sXrcqshaff
Regenerates README indexes and deletes the CH-001 change workspace now that every task is done; docs/capabilities/CAP-001-published-container-image, docs/goals/G-001, and docs/decisions/ADR-001 carry the durable record. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hma5K774H256sXrcqshaff
flemming-n-larsen
marked this pull request as ready for review
September 12, 2026 22:48
flemming-n-larsen
marked this pull request as draft
September 12, 2026 22:52
Closes the review's advisory gap: a package GITHUB_TOKEN creates on GHCR is not guaranteed public, which would silently defeat AC-001. publish.yml now sets visibility to public after pushing and fails the run if an anonymous pull of the just-pushed tag doesn't work. Also moves the tag/push step's version interpolation into an env var instead of the run: script body. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hma5K774H256sXrcqshaff
Review found that GitHub's API has no operation to change a package's visibility, so the prior fix's "Set the GHCR package to public" step would 404 on every run. Remove it; the pull-confirmation step now fails loudly and names the real, one-time manual fix (GHCR package settings), and RELEASING.md/design.md describe that honestly instead of claiming automation that doesn't exist. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hma5K774H256sXrcqshaff
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Acceptance brief
Plan item: none — this change is explicitly plan-less (proposal.md declared it so; no
docs/plans/entry exists for release/distribution work).Vision: proceeds under
VIS-001("Enable community-run ranked Tank Royale battles"), whose success statement already names "the documented container workflow"; this change makes that workflow obtainable without a local build.Criteria added/changed (
docs/capabilities/CAP-001-published-container-image/criteria.md):@AC-001Tagging a release publishes a pullable versioned image —Test-type: Human. Proof: this brief, corroborated bypublish.yml's own anonymous-pull confirmation step. Verified by pushing a realvX.Y.Ztag after merge; on the very first release the confirmation step is expected to fail once (GitHub has no API to set package visibility — see below) until a maintainer sets the package public by hand.@AC-002Ordinary commits to main never publish an image —Test-type: Human. Proof: this brief;publish.yml's trigger ispush: tags: ['v*.*.*']only.@AC-003Every published version has a changelog entry —Test-type: Human. Proof: this brief andRELEASING.md's process, enforced by convention, not CI.What this merge binds:
CAP-001(published container image),G-001(proposed goal), andADR-001(GHCR + tag-trigger + manual-versioning decision,status: inferred; merging makes it binding per Decision records, thoughverifiedstill needs an explicit human approval statement). No unmerged base is depended on.Verification
clue validate: OK (7 artifacts, 1 inferred decision awaiting verification — ADR-001).publish.ymlcross-checked againstbuild.yml's existingdockerjob andscripts/verify-container.sh.dd86a67— no blocking findings; two advisories (stale "development image" README wording; GHCR package-visibility gap that could make AC-001 silently fail).9c57e30(repair attempt for the visibility advisory) — blocking finding: the repair calledgh api PATCH .../packages/container/.../visibility=public, an endpoint GitHub's REST API does not expose, so the step would 404 every run and the commit/docs falsely claimed automation that doesn't exist.c7df0c9(current HEAD) — repairs that finding honestly: removes the nonexistent API call, keeps the anonymous-pull confirmation step as a loud, actionable failure (::error::+exit 1naming the real one-time manual fix), and correctsRELEASING.md/design.mdto describe it accurately. Clean pass, no blocking findings, no new advisories.README.md:54still says "development image" after this PR renamed that section — cosmetic, worth a follow-up.🤖 Generated with Claude Code
https://claude.ai/code/session_01Hma5K774H256sXrcqshaff