docs: correct release image tag (no v prefix) + document read:packages#318
Merged
Merged
Conversation
Cutting v0.1.0-beta.1 surfaced two doc bugs that break the documented
verify/deploy flow:
1. The image tag has no `v`. `docker/metadata-action`'s {{version}} strips the
leading `v` from the git tag, so the pushed image is `…:0.1.0-beta.1`, not
`…:v0.1.0-beta.1`. Every verify/deploy example used the `v`-prefixed form,
which fails with MANIFEST_UNKNOWN (verify) / ImagePullBackOff (deploy).
Fixed the examples in RELEASING.md, DEPLOYMENT.md (prose + embedded template
+ install snippet), the Helm chart (deployment.yaml comment + `required`
message, values.yaml comment), and the docs-site mirror. The cosign
`@refs/tags/v` identity regexp is left as-is — it matches the git tag ref,
which correctly keeps its `v`.
2. GHCR release packages are private by default, so `cosign verify` /
`gh attestation verify` need a token with the `read:packages` scope (separate
from repo access). Documented the prerequisite + the login step in
RELEASING.md's "Verifying a release" section.
Doc-only; no app behaviour change.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![icebergai-review-bot[bot]](https://avatars.githubusercontent.com/u/290878036?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
IcebergAutoReview
Verdict: approve
The documentation corrections match the release workflow’s actual tag generation and preserve the correct v-prefixed Git identity regex. The change is focused, secure, and internally consistent.
Findings
- No blocking findings.
Validation
- Inspected complete
main...HEADdiff and affected release/deployment context. - Confirmed
mainis the direct ancestor; PR contains one commit modifying only the five stated files. - Verified
.github/workflows/release.ymlusestype=semver,pattern={{version}}. - Searched for remaining incorrect
v-prefixed deployment/verification examples; only intentional Git-tag and synthetic test references remain. - Ran
git diff --checksuccessfully. - Attempted an offline Helm render, but Helm is not installed locally; current-head CI is green and authoritative for chart rendering.
Residual risks / optional notes
- None identified.
Automated review by Codex ceeea4ca84a2 using IcebergAutoReview.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cutting v0.1.0-beta.1 (release v0.1.0-beta.1) surfaced two documentation bugs that break the documented verify/deploy flow. Both are doc-only.
1. The release image tag has no
vprefixdocker/metadata-action's{{version}}strips the leadingvfrom the git tag, so the pushed image isghcr.io/icebergai/icebergebs:0.1.0-beta.1— not:v0.1.0-beta.1. Confirmed against the published package (tags:0.1.0-beta.1,sha-1240dab). Every verify/deploy example used thev-prefixed form:cosign verify …:v0.1.0-beta.1→MANIFEST_UNKNOWN--set image.tag=v0.1.0-beta.1→ImagePullBackOffCorrected in
docs/RELEASING.md,DEPLOYMENT.md(prose + embedded rendered-template + install snippet), the Helm chart (deployment.yamlcomment +requiredmessage,values.yamlcomment), and the docs-site mirrorwebsite/docs/deployment.md. The cosign@refs/tags/videntity regexp is left as-is — it matches the git tag ref, which correctly keeps itsv.2.
read:packagesprerequisite for verificationGHCR release packages are private by default, so
cosign verify/gh attestation verifyneed a token with theread:packagesscope (separate from repo access — arepo-scoped token authenticates but is denied the manifest pull). Documented the prerequisite + login step in RELEASING.md.Both checks were run successfully against the real release after correcting the tag:
release.yml@refs/tags/v0.1.0-beta.1, commit1240dabNot changed
CHANGELOG.md:685— a historical entry describing Helm chart deploys mutable :latest with pullPolicy IfNotPresent — upgrades don't upgrade #88 carries the samev-prefixed example; left untouched per the append-only changelog convention.🤖 Generated with Claude Code