release-rome-image

# Release a new Rome image A pushed `vX.Y.Z` tag is the release. `.github/workflows/docker-publish.yml` builds the multi-arch image and publishes it to `yunfanye/rome`, with no approval gate between the push and Docker Hub. Get explicit confirmation before the push. Verify the published image after it. The tagging contract covering the semver gate, tag immutability, and `latest` movement lives in [docs/releases.md](../../../docs/releases.md#tagging-contract). ## Out of scope - Desktop releases use the `desktop-v*` tag and a separate pipeline. - npm package releases belong to release-please. Never create those tags by hand. ## 1. Preflight The tag lands on `origin/main`, and `docker-publish.yml` runs no CI gate of its own. 1. Read the commit that the tag will point at. ```bash git fetch origin --tags && git rev-parse origin/main ``` 2. List the recent CI runs. ```bash gh run list --branch main --workflow CI --limit 5 ``` 3. Find the run for the exact commit from step 1 and confirm the status is `success`. CI cancels superseded runs, so a rapid series of merges leaves `cancelled` runs on real commits. If the run failed, was cancelled, or is still running, stop and report it. 4. Confirm no release is already in flight. ```bash gh run list --workflow "Docker Hub Publish" --limit 3 ``` ## 2. Pick the version 1. Read the current stable tags. ```bash git tag --list 'v[0-9]*' | sort -V | tail -5 ``` 2. For a patch release, use the ...