[ccf-lisa]

Task: W1-S2-T03

Part 3 of 3 of the api onboarding stack (CCF Release Automation Design). Stacked on #487.

Moves the image publishing to the shared release workflows, pinned at the v1.5.0 release commit (899dbe5).

Removes: .github/workflows/publish.yml. No other workflow called it.

Changes

• release.yml: calls release-go-image.yml on release: published and publishes ghcr.io/compliance-framework/api (one image: Dockerfile, context .).
• preview.yml: calls preview.yml with kind image and on-main: true. The concurrency group is keyed by PR number, as on mock-api.
• cut-prerelease.yml: workflow_dispatch caller of cut-prerelease.yml, which tags the next rc of the version the open release-please PR proposes.
• Dockerfile (production stage only): declares ARG VERSION=dev and restores the OCI labels the old metadata-action step added (details below).
• AGENTS.md: the release paragraph described the removed publish workflow; it now describes release-please, release.yml, preview.yml and cut-prerelease.

Published artifacts: old vs new

	Old (publish.yml)	New (release.yml + preview.yml)
Image	ghcr.io/compliance-framework/api	same
Dockerfile and stage	Dockerfile, last stage (production)	same
Platforms	linux/amd64, linux/arm64 (QEMU on one runner)	same, built on native amd64 and arm64 runners and merged into one manifest list
Provenance attestation	yes (build-push-action default)	yes
Final release vX.Y.Z	X.Y.Z, X.Y, X, latest, sha-<7>	X.Y.Z, X.Y, X, latest
Release candidate vX.Y.Z-rcN	X.Y.Z-rcN, sha-<7>	X.Y.Z-rcN
Push to main	main, latest, sha-<7>	main, sha-<7> (latest no longer moves)
Push to seed	seed, sha-<7>	nothing (trigger removed)
PR	nothing	pr-<number> when the PR has the preview label
Build args	none	VERSION=<version> only (X.Y.Z, X.Y.Z-rcN, main-<sha7>, pr-<n>-<sha7>)
OCI labels	metadata-action: title, description, url, source, version, created, revision, licenses	workflow: source, revision; Dockerfile: title, description, url, licenses, version. created is no longer set

Notes:

• The old final-release sha-<7> tag pointed at the tag build of the release commit. That commit is on main, so the new main preview still publishes a sha-<7> for it, from the main build.
• On GHCR today, 0, 0.21, 0.21.0 and latest share one digest, so the floating X tag the new flow keeps was already published.
• The old flow passed no build args. The Dockerfile had no ARG VERSION, so without the change above the new VERSION arg would be ignored (with a build warning). It is now used only for the org.opencontainers.image.version label. The binary is built exactly as before.

Open questions for reviewers

• The old publish workflow also ran on pushes to a seed branch. That branch no longer exists, and GHCR has no seed tag. Is a seed image still needed? This PR drops the trigger.

Before and after merging (human)

• The release and cut-prerelease jobs mint ccf-release-bot tokens from the repo's release environment, which repo-settings creates (W1-S2-PRE, per-repo order).
• From the repo-settings apply on, rcs come only from cut-prerelease; nobody pushes v* tags by hand.

Verified

• Every new caller is pinned at 899dbe5 (v1.5.0), has a top-level permissions block and grants packages: write only to the publishing job.
• Tag rules checked against internal/release (ReleaseTags, PreviewTags) at v1.5.0.
• Current GHCR tags and the 0.21.0 image config (platforms, labels, entrypoint) checked against the table above.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e172b1d4-cec9-46ea-be22-b0aee3a9812a

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}