fix: scope sandbox-images tag trigger to semver, exclude bare v0/v1

[waynesun09]

Summary

• Narrow sandbox-images.yml tag filter from v* to v[0-9]+.[0-9]+* so bare floating tags like v0, v1 don't trigger sandbox image builds
• release.yml keeps its original v[0-9]+.[0-9]+.[0-9]+* pattern (GoReleaser requires three-component semver)

Excluding bare major tags (v0, v1, etc.) supports tagging reusable workflow refs (e.g. fullsend-ai/fullsend@v0) without triggering the sandbox-images pipeline.

Test plan

• Verify v0 tag does not trigger sandbox-images workflow
• Verify v0.1.0 tag would still match both workflow patterns

[github-actions]

fullsend review is working on this — view logs

[github-actions]

Site preview

Preview: https://f1773528-site.fullsend-ai.workers.dev

Commit: b0eab194843060144a6b582d42030fa4cbe34048

[fullsend-ai-review]

Review: #901

Head SHA: b0eab19
Timestamp: 2026-05-13T00:00:00Z
Outcome: approve

Summary

Clean, minimal change that narrows the sandbox-images workflow tag trigger from v* to v[0-9]+.[0-9]+*, excluding bare major-version tags (v0, v1) while preserving all semver tag matches. This enables using bare major tags for reusable workflow refs without triggering sandbox image builds. The pattern is consistent with the existing release.yml style, the comment update accurately reflects the new behavior, and no permissions or security-relevant configuration is modified. No findings across all six review dimensions.

Findings

No findings.

Footer

Outcome: approve
This review applies to SHA b0eab194843060144a6b582d42030fa4cbe34048. Any push to the PR head clears this review and requires a new evaluation.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/sandbox-images.yml

Previous run

Review: #901

Head SHA: 3020ff7
Timestamp: 2026-05-13T00:00:00Z
Outcome: approve

Summary

Clean, well-scoped change that aligns both workflow tag triggers to the same v[0-9]+.[0-9]+* pattern. The sandbox-images filter is correctly narrowed from the overly broad v*, and the release filter is intentionally broadened from v[0-9]+.[0-9]+.[0-9]+* to also accept X.Y tags. The comment update in sandbox-images.yml accurately reflects the new behavior. No correctness, security, or injection concerns.

Findings

Info

• [correctness] .github/workflows/release.yml:6 — 2-part version tags (e.g., v0.1) will now trigger GoReleaser, which uses prerelease: auto (semver-based detection). Since 0.1 is not strictly valid semver (missing patch component), confirm GoReleaser handles this gracefully rather than erroring or misclassifying the release. The same applies to docker/metadata-action's type=semver patterns in sandbox-images.yml, which may not extract {{major}}.{{minor}} components from a 2-part tag. Non-semver fallback tags (type=sha, type=raw) will still apply, so builds won't fail — but semver-derived Docker tags may be absent for X.Y-only releases.

Footer

Outcome: approve
This review applies to SHA 3020ff71fdf21ca0051e97e0f169e7b5e16bddf4. Any push to the PR head clears this review and requires a new evaluation.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/release.yml
• .github/workflows/sandbox-images.yml

[github-actions]

fullsend review is working on this — view logs