feat(ci): render Docker Hub readme from versions.yml at build time

[kojiromike]

Fixes #709

Short description of what this resolves:

Step 15 of the release runbook — updating the Docker Hub readme on https://hub.docker.com/r/openemr/openemr — was manual: maintainers edited docker/openemr/OVERVIEW.md by hand, then a workflow propagated it to Docker Hub. This PR removes that manual step. The readme is now rendered from tools/release/versions.yml (the same registry the slot rotation workflow already uses) and pushed by each production build workflow after a successful image push.

Changes proposed in this pull request:

• New Twig template tools/release/templates/dockerhub-overview.md.twig (renamed from docker/openemr/OVERVIEW.md, with version-dependent values parameterized on slot scalars).
• New renderer OpenEMR\Release\DockerHubOverviewRenderer (tools/release/src/) with a thin Symfony Console wrapper at tools/release/bin/render-dockerhub-overview.php and a release:render-dockerhub-overview Task entry. Unit tests cover slot interpolation, determinism, and error paths.
• New composite action .github/actions/push-dockerhub-readme that checks out, renders, then calls peter-evans/dockerhub-description@v5.
• Build workflows build-704, build-800, build-810, build-811 call the composite action as their final step (last-writer-wins is benign because renders are deterministic).
• Retire .github/workflows/dockerhub-description.yml and the hand-edited docker/openemr/OVERVIEW.md. Drop the corresponding entry from tools/release/versions.yml.
• Drop the per-build dated tags (e.g. 8.0.0.3-2026-03-25) from the readme — they're an immutable-naming mechanism for pinning, not date-display, and Docker Hub's Tags page already lists them. Replaced with one sentence explaining the scheme.

Notes

• Blocked on the Docker Hub credential rotation in fix(ci): rotate revoked DOCKERHUB_TOKEN — readme workflow returning Forbidden #714 — the previous workflow has been failing with Forbidden on its last two runs. The new push uses the same DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets, so the same fix unblocks both.
• Flex tracks (build-322, build-323, build-edge, build-flex-core) are intentionally not wired up — they aren't in the rotation registry and their portion of the readme is hand-curated. Easy follow-up if/when they join the rotation.
• Follow-up on openemr/openemr to remove step 15 from docs/RELEASE_PROCESS.md's release runbook.

Test plan

• composer check clean in tools/release/ (phpcs, phpstan, rector dry-run, require-checker, phpunit — 83 tests).
• actionlint clean on the four modified build workflows.
• Local render of the template against the real versions.yml produces the expected markdown.
• End-to-end push verifiable once fix(ci): rotate revoked DOCKERHUB_TOKEN — readme workflow returning Forbidden #714 lands: workflow_dispatch on build-800.yml from a topic branch and confirm the Docker Hub readme reflects the rendered output.

[Copilot]

Pull request overview

Automates Docker Hub README updates for openemr/openemr by rendering a deterministic Markdown document from tools/release/versions.yml at build time, replacing the prior manual-edit + standalone workflow approach.

Changes:

• Add a Twig-based README template and a PHP renderer + CLI/Taskfile entry to render from versions.yml.
• Add a composite GitHub Action to render and push the Docker Hub description via peter-evans/dockerhub-description@v5.
• Wire the composite action into production build workflows and remove the old dockerhub-description.yml workflow.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/release/versions.yml	Removes the retired OVERVIEW.md mapping entry from the rotation registry.
tools/release/templates/dockerhub-overview.md.twig	New Docker Hub README template parameterized by slot scalars.
tools/release/src/DockerHubOverviewRenderer.php	New renderer to load versions.yml slots and render the Twig template.
tools/release/bin/render-dockerhub-overview.php	New CLI wrapper to render to stdout or a file for CI usage.
tools/release/Taskfile.yml	Adds a release:render-dockerhub-overview task (deps: setup).
tools/release/tests/DockerHubOverviewRendererTest.php	Adds unit tests for slot interpolation, determinism, and error cases.
.github/actions/push-dockerhub-readme/action.yml	New composite action to checkout, render README, and push to Docker Hub.
.github/workflows/build-704.yml	Runs the composite action after pushing the legacy 7.0.4 image.
.github/workflows/build-800.yml	Runs the composite action after pushing the current production image.
.github/workflows/build-810.yml	Runs the composite action after pushing the next-track manifest/tags.
.github/workflows/build-811.yml	Runs the composite action after pushing the dev-track manifest/tags.
.github/workflows/dockerhub-description.yml	Removes the old workflow that pushed a hand-edited README file.

Comments suppressed due to low confidence (1)

tools/release/templates/dockerhub-overview.md.twig:21

• The dated-tag example hard-codes 2026-03-25, which will become stale and potentially confusing over time. Consider using a generic placeholder (e.g. {{ current.patch }}-YYYY-MM-DD) or wording that avoids a specific date in the example while still illustrating the format.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.