Use semver DevSH image tags

Author: AnastaZIuk

.github/workflows/devsh-foss-image.yml

@@ -44,7 +44,8 @@ jobs:
           if [ -n "${requested}" ]; then
             image_tag="${requested}"
           else
-            image_tag="devsh-$(date -u +%Y%m%d%H%M%S)-${GITHUB_SHA:0:12}"
+            base_version=$(python3 -c 'import json; print(json.load(open("package.json"))["version"])')
+            image_tag="${base_version}-devsh.$(date -u +%Y%m%d%H%M%S).${GITHUB_SHA:0:12}"
           fi
           echo "image-tag=${image_tag}" >> "${GITHUB_OUTPUT}"
           echo "IMAGE_TAG=${image_tag}" >> "${GITHUB_ENV}"
@@ -54,8 +55,7 @@ jobs:
         run: |
           set -euo pipefail
           case "${IMAGE_TAG}" in
-            devsh-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]-*) ;;
-            8.*-devsh.*) ;;
+            [0-9]*.[0-9]*.[0-9]*-devsh.[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9].*) ;;
             *) echo "Invalid image tag for DevSH rollout: ${IMAGE_TAG}" >&2; exit 1 ;;
           esac
 

DEVSH.md

@@ -19,25 +19,25 @@ The `DevSH FOSS image` workflow builds a fully self-hosted FOSS Rocket.Chat imag
 4. Run `yarn fossify`, which removes Enterprise and commercial source directories.
 5. Build the Meteor production bundle.
 6. Build and verify the Docker image.
-7. Publish immutable tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`.
+7. Publish immutable semver-compatible tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`.
 
 Runtime validation happens after deployment through the TerraInfra Rocket.Chat E2E checks. The image workflow stays focused on producing and publishing the DevSH FOSS container.
 
 ## Image Tags
 
 Pushes to `devsh` publish:
 
-- `devsh-YYYYMMDDHHMMSS-<sha>` as the immutable rollout tag.
+- `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` as the immutable rollout tag.
 - `devsh` as a moving convenience tag.
 
-Terraform/Flux uses only immutable `devsh-YYYYMMDDHHMMSS-<sha>` tags for production rollouts.
+Terraform/Flux uses only immutable semver-compatible DevSH tags for production rollouts because the upstream Helm chart runs semver checks against `.Values.image.tag`.
 
 ## TerraInfra Integration
 
 TerraInfra watches the GHCR package with Flux image automation:
 
 - `ImageRepository`: `ghcr.io/devsh-graphics-programming/rocketchat-foss`
-- `ImagePolicy`: newest immutable `devsh-YYYYMMDDHHMMSS-<sha>` tag
+- `ImagePolicy`: newest immutable semver-compatible DevSH tag
 - `ImageUpdateAutomation`: commits the selected tag to `env/prod`
 
 After Flux commits the tag update, the Rocket.Chat HelmRelease rolls the deployment on `prod-rocket-01`.

README.md

@@ -1,5 +1,5 @@
 > [!IMPORTANT]
-> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable `devsh-YYYYMMDDHHMMSS-<sha>` tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra/Flux consumes those tags for production rollout on `prod-rocket-01`.
+> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable semver-compatible `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra/Flux consumes those tags for production rollout on `prod-rocket-01`.
 >
 > Keep runtime infrastructure changes in TerraInfra. Keep this fork close to upstream Rocket.Chat and use `DEVSH.md` for the DevSH branch/build model.