ci: pin branch-built images into the chart on release-* branches (#1994)

[cyberantonz]

What

Completes the release-branch half of #1994: a build on a release-* branch now pins the freshly pushed branch-suffixed images into the chart and publishes it with a patch-only umbrella version bump. This is collision-safe because trunk's minor version is bumped right after a release branch is cut, so the branch's x.y.Z patch stream and main's stream never overlap on the OCI registry.

Why nothing was pinned before

• bump-descriptors and publish-chart were hard-gated github.ref == 'refs/heads/main'.
• Even if opened up, the flow could not converge: bump-descriptors commits without [skip ci] and relies on the resulting push re-triggering the workflow (toolbox rebake with patched descriptors + deferred publish-chart) — but on.push only covered main, so on a release branch that follow-up run never fires.
• The umbrella appVersion sanity regex deliberately rejects the branch-suffixed tag form.

Changes

1. on.push / on.pull_request: add release-** — release-branch pushes get the same paths-filtered build → pin → publish machinery as main, and the bump-descriptors auto-commit re-triggers the workflow exactly like it does on main.
2. dorny/paths-filter gets base: ${{ github.ref_name }} — without it, dorny diffs a release-branch push against the repo default branch and marks every service changed on every push. With base=ref_name the per-push diff semantics main has always had apply to release branches too. (Ignored on pull_request; on workflow_dispatch it yields no-diff, same as today — dispatch builds fire via the full-rebuild condition.)
3. Ref gates on bump-descriptors / publish-chart widened to main || startsWith(ref_name, 'release-').
4. Umbrella appVersion regex: non-main refs accept the branch-suffixed tag shape (YYYY.MM.DD.HH.MM-sha7.<branch>); main keeps the strict suffix-less regex as the backstop against branch tags leaking into main-published charts.

Unchanged: latest image tag stays main-only; PR runs still build without pushing; umbrella bump is patch-only (existing behavior).

Resulting flow on a release branch

• gh workflow run build-images.yml --ref release-YYYY.MM.N (full rebuild) → all images pushed with .release-YYYY.MM.N-suffixed tags → bump-descriptors pins connector descriptors + service subchart appVersions and commits → that push re-triggers → toolbox rebakes, publish-chart bumps the umbrella patch version and publishes oci://ghcr.io/constructorfabric/charts/insight:<x.y.Z+1>.
• A plain push (e.g. a merged backport) to the branch auto-builds only the changed images and publishes the pinned chart, same as main.
• Frontend: a manual dispatch on the release ref with frontend_tag=<tag> pins the frontend subchart without rebuilding backends (the cross-repo auto-dispatch from insight-front remains main-only).

Notes

• Descriptor version: bumps stay minor on release branches (per ADR-0015 the minor bump drives catalog re-discovery without a full refresh — same rationale as main; descriptor versions are compared per-environment, not across chart streams).
• The very first push that creates a release-* branch may build everything once (paths-filter can't diff an initial push) — that gives the branch its own tagged image baseline, which is desirable.
• Verified release-* branches carry no branch protection, so the App-token auto-commits push cleanly.

Refs #1994

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Expanded image build automation to support both the main branch and release branches.
  • Release branches now receive branch-specific image tags.
  • Descriptor and chart publishing is supported for eligible release branches.
  • Main-branch-only safeguards remain in place for the latest tag and strict version validation.
  • Improved branch-aware chart validation and publishing commit messages.

[coderabbitai]

Warning

Review limit reached

@cyberantonz, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 14 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 780e839a-88e8-4ffb-812d-0d328f55c31c

📥 Commits

Reviewing files that changed from the base of the PR and between fa5f7b864e3ef6ba385c7c0f239d4f965b834574 and 4043fda.

📒 Files selected for processing (1)

• .github/workflows/build-images.yml

📝 Walkthrough

Walkthrough

The workflow now builds images for main and release-* branches. Release branches use branch-specific tags and support descriptor and chart publishing. Main-only latest tagging and strict appVersion validation remain unchanged.

Changes

Release branch publishing

Layer / File(s)	Summary
Branch triggers and image tags .github/workflows/build-images.yml	Push and pull-request triggers include release-* branches. Release builds use branch-suffixed image tags.
Branch-aware publishing flow .github/workflows/build-images.yml	Descriptor and chart publishing support main and release-* branches. Path filtering uses the current ref. Release branches use patch-only chart versioning.
Branch-aware validation and commits .github/workflows/build-images.yml	Non-main refs accept sanitized branch suffixes in umbrella appVersion. Version-bump commits target the triggering branch.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• [EPIC] Branch image builds: push branch-tagged images to GHCR (manual first, auto for release-* later) #1994 — Implements branch-triggered image builds and branch-specific tagging for release-* branches.

Possibly related PRs

• constructorfabric/insight#2004 — Also updates branch-aware image tags and publishing in build-images.yml.
• constructorfabric/insight#2009 — Also modifies branch-based image tag generation and sanitized branch suffix validation.
• constructorfabric/insight#1684 — Related to chart publishing workflow changes.

Suggested reviewers: ktursunov, mozhaev-dev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes pinning branch-built images into the chart for release-* branches.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-images.yml:
- Line 988: Update the release-gating conditions at the referenced workflow
checks, including the expressions near the main/release jobs, to match full
branch refs only: permit refs/heads/main or refs/heads/release-.* and reject tag
refs. Replace github.ref_name-based release matching with github.ref checks
while preserving the existing main-branch allowance.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 793602f2-c7ba-4e4e-99db-56d83e2c09b0

📥 Commits

Reviewing files that changed from the base of the PR and between b908f1c and fa5f7b864e3ef6ba385c7c0f239d4f965b834574.

📒 Files selected for processing (1)

• .github/workflows/build-images.yml