* feat(ci): publish omnigraph-server container image to GHCR on release
Build binaries inside a rust:1-bookworm container (matching the
Dockerfile's bookworm-slim runtime glibc) with the aws feature enabled,
then build and push ghcr.io/<owner>/omnigraph-server:<tag>. Separate
from release.yml so an image failure never blocks the binary release,
and a workflow_dispatch backfill of a past tag never re-runs the release
matrix or repoints :latest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* review fixes: validate dispatch tag (existing v* only), document workflow + GHCR image
- Guard workflow_dispatch: the free-form tag input must name an EXISTING
v* tag (gh api ref check) and checkout is pinned to refs/tags/<tag>,
so a branch/SHA can never be published under a release-looking image
tag (greptile P1).
- docs/dev/ci.md: add the publish-image.yml entry (same-PR docs rule).
- docs/user/deployment.md: document pulling the prebuilt GHCR image.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
