chore: dispatch completed releases to packaging

[ndizazzo]

Summary

• dispatch successful complete non-canary releases to Mesh-LLM/mesh-agent-images after GitHub Release publication
• enable package assets and GHCR image publication in the production payload
• retire upstream tag-based GHCR publishing and retain only manual Dockerfile validation
• document the release ownership boundary

Validation

• actionlint
• workflow YAML and duplicate-step-ID checks
• just check-release
• receiver repository_dispatch dry run: https://github.com/Mesh-LLM/mesh-packaging/actions/runs/29512465086

Before merge

• provision MESH_AGENT_IMAGES_DISPATCH_TOKEN as a fine-grained token or GitHub App token scoped to Mesh-LLM/mesh-agent-images with Contents write access
• merge with the coordinated Mesh-LLM/mesh-agent-images ownership PR

No package, image, or release asset was published.

Summary by CodeRabbit

• New Features
  • Completed non-canary releases can now automatically dispatch post-release packaging and publish native release assets and the supported container image set.
• Bug Fixes
  • Updated the client container workflow to validate the client Dockerfile via build checks without publishing images.
• Documentation
  • Refreshed release and CI docs to clarify dispatch-driven packaging/publishing behavior, required dispatch token permissions, and that Docker workflow performs validation only.

[github-actions]

This pull request is currently a draft. Reviews will not take place until the PR is marked as ready for review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 344327fe-313d-4876-acbb-f8d35683eb91

📥 Commits

Reviewing files that changed from the base of the PR and between f939832 and 1561fb8.

📒 Files selected for processing (4)

• .github/workflows/docker.yml
• .github/workflows/release.yml
• RELEASE.md
• ci/ci.md

🚧 Files skipped from review as they are similar to previous changes (2)

• .github/workflows/docker.yml
• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

The Docker workflow now performs manual Dockerfile validation only. The release workflow dispatches completed releases to Mesh-LLM/mesh-agent-images for packaging and image publishing, with corresponding release and CI documentation updates.

Changes

Release packaging workflow split

Layer / File(s)	Summary
Manual Dockerfile validation .github/workflows/docker.yml	The workflow is manually triggered, uses read-only contents permissions, and validates docker/Dockerfile.client with Buildx without publishing images.
Post-release packaging dispatch .github/workflows/release.yml	A conditional dispatch_packaging_release job checks for the dispatch token and sends release metadata and publishing flags to Mesh-LLM/mesh-agent-images after a successful publish.
Release workflow documentation RELEASE.md, ci/ci.md	Documentation describes the dispatch prerequisite, packaging ownership, GHCR publishing responsibility, and manual Dockerfile validation behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant publish
  participant dispatch_packaging_release
  participant MeshAgentImages
  publish->>dispatch_packaging_release: successful full release
  dispatch_packaging_release->>MeshAgentImages: POST mesh-llm-release dispatch
  MeshAgentImages->>MeshAgentImages: package archives and publish release assets and GHCR images

Loading

Possibly related PRs

• Mesh-LLM/mesh-llm#918: Modifies release and publish gating connected to the new post-publish packaging dispatch.
• Mesh-LLM/mesh-llm#996: Changes release tag and version staging logic used by the dispatch payload.

Suggested reviewers: i386

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: dispatching completed releases to the packaging repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/dispatch-packaging-release

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/docker.yml:
- Around line 17-18: Update the actions/checkout@v5 step in the workflow to set
persist-credentials to false. Leave the docker/setup-buildx-action@v4 step
unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 86147e93-bb62-4182-bb26-7786221a771c

📥 Commits

Reviewing files that changed from the base of the PR and between b84dd14 and f939832.

📒 Files selected for processing (4)

• .github/workflows/docker.yml
• .github/workflows/release.yml
• RELEASE.md
• ci/ci.md