Publish semver stable image channel

Author: AnastaZIuk

.github/workflows/devsh-foss-image.yml

@@ -40,16 +40,20 @@ jobs:
         id: image
         run: |
           set -euo pipefail
+          base_version=$(python3 -c 'import json; print(json.load(open("package.json"))["version"])')
+          stable_tag="${base_version}-devsh"
           requested='${{ inputs.image_tag }}'
           if [ -n "${requested}" ]; then
             image_tag="${requested}"
           else
-            base_version=$(python3 -c 'import json; print(json.load(open("package.json"))["version"])')
             image_tag="${base_version}-devsh.$(date -u +%Y%m%d%H%M%S).${GITHUB_SHA:0:12}"
           fi
           echo "image-tag=${image_tag}" >> "${GITHUB_OUTPUT}"
+          echo "stable-tag=${stable_tag}" >> "${GITHUB_OUTPUT}"
           echo "IMAGE_TAG=${image_tag}" >> "${GITHUB_ENV}"
+          echo "STABLE_TAG=${stable_tag}" >> "${GITHUB_ENV}"
           echo "Publishing ${IMAGE}:${image_tag}"
+          echo "Publishing ${IMAGE}:${stable_tag}"
 
       - name: Validate image tag
         run: |
@@ -211,6 +215,7 @@ jobs:
             --label "org.opencontainers.image.source=https://github.com/Devsh-Graphics-Programming/Rocket.Chat" \
             --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
             --tag "${IMAGE}:${IMAGE_TAG}" \
+            --tag "${IMAGE}:${STABLE_TAG}" \
             --tag "${IMAGE}:devsh" \
             --file "${GITHUB_WORKSPACE}/apps/meteor/.docker/Dockerfile.alpine" \
             /tmp/dist
@@ -226,4 +231,5 @@ jobs:
         run: |
           set -euo pipefail
           docker push "${IMAGE}:${IMAGE_TAG}"
+          docker push "${IMAGE}:${STABLE_TAG}"
           docker push "${IMAGE}:devsh"

DEVSH.md

@@ -29,9 +29,9 @@ Runtime validation happens after deployment through the TerraInfra Rocket.Chat E
 Pushes to `devsh` publish:
 
 - `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` as the immutable audit and rollback tag.
-- `devsh` as the stable production channel tag.
+- `<rocket-version>-devsh` as the stable production channel tag.
 
-TerraInfra points the Rocket.Chat HelmRelease at the stable `devsh` tag with `imagePullPolicy=Always`. Immutable tags remain available for audit, debugging, and explicit rollback.
+TerraInfra points the Rocket.Chat HelmRelease at the stable semver-compatible channel tag with `imagePullPolicy=Always`. Immutable tags remain available for audit, debugging, and explicit rollback. The channel tag must stay semver-compatible because the upstream Helm chart evaluates `.Values.image.tag` with `semverCompare`.
 
 ## TerraInfra Integration
 
@@ -42,7 +42,7 @@ TerraInfra uses the standard DevSH image rollout model:
 - Digest rollout hook for immediate deployment restarts when the `devsh` digest changes
 - Digest rollout CronJob as fallback
 
-Do not add TerraInfra tag bump workflows to this fork. Publishing a new `devsh` package is enough; the cluster observes the digest change and rolls itself forward.
+Do not add TerraInfra tag bump workflows to this fork. Publishing a new package that updates the stable channel tag is enough; the cluster observes the digest change and rolls itself forward.
 
 ## Operational Rule
 

README.md

@@ -1,5 +1,5 @@
 > [!IMPORTANT]
-> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable semver-compatible `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` tags plus the stable `devsh` channel tag to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra rolls `prod-rocket-01` from the stable channel digest.
+> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable semver-compatible `<rocket-version>-devsh.YYYYMMDDHHMMSS.<sha>` tags plus the stable semver-compatible `<rocket-version>-devsh` channel tag to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra rolls `prod-rocket-01` from the stable channel digest.
 >
 > Keep runtime infrastructure changes in TerraInfra. Keep this fork close to upstream Rocket.Chat and use `DEVSH.md` for the DevSH branch/build model.