- the stable channel opens a pull request and the preview channel pushes to main, both from a fresh clone of the CDN
- the stable pull request now branches off main after the preview push, so a release that moves both latest and preview no longer leaves it with a conflict in versions.json
- scripts/tmp-remove-arch-tags.sh lists the arch tags such as 4.1.2-amd64 whose image a multi-platform tag still reaches, and removes as many as --remove asks for
- A registry deletes a tag only with its image, so --remove moves each arch tag to a placeholder manifest and deletes the placeholder, the image stays, as the multi-platform manifest points at it by digest
- enable full provenance attestation explicitly for every image build
- attach an SBOM attestation to every image, which lists every package of the image
- name the files and workflows like the release workflows and every step after what it does
- run all workflows without the GitHub Actions cache like the release workflow
- Removes coolify-testing-host.yml too, it published the testing host to Docker Hub for docker-compose.windows.yml alone, the development setup builds it locally
- Docker Compose builds the development helper from the main branch of that repository, scripts/dev-helper from there or from a local checkout
- Remove buildHelperImage from the settings, nothing calls it since its button was removed
- An upstream line is tagged v<upstream>-v<version> in git instead of <upstream>-v<version>
- Coolify has no upstream lines, its git tags stay v<version>, and the v is stripped from the Docker image tags
- Moves the main tag on ghcr.io when main changed since the last build, versioned after the stable version like 4.5.0.20261028.1
- Pushes no version tag, so the clean manifests workflow deletes the build it replaces
- version.sh --main picks the version from MAIN_VERSION and MAIN_REVISION, the labels of the build main points at
- Remove other/nightly, the nightly channel uses the production files, so there are no longer two copies to keep in sync
- sync-cdn.sh --nightly syncs the files of the commit the nightly is built from to /coolify/nightly on the CDN, with the nightly version in its versions.json and in /coolify/release.json, and pushes them straight to main of coollabs-cdn
- version.sh picks the branch the nightly comes from, the release branch of the next version after the newest stable one or next, and names the version <preview>.<YYYYMMDD>.<N>
- The image is labeled with its version and commit, the nightly workflow reads both from the image nightly points at to count up N and to skip a run without a new commit
- config/constants.php reads the Coolify and helper versions from them
- The image and sync-cdn.sh write versions.json from upstream.json, install.sh reads it by key
- with a run every hour and 200 deletions per run the about 35,000 unused manifests on ghcr.io and docker.io are deleted in about 7 days, then the schedule goes back to every 2 weeks or every month
- a run deletes 200 at most, as GitHub allows an account 500 requests per hour and the ghrc.io PAT is an account level PAT
Build release/vX.Y pushes for amd64 and aarch64, then publish
X.Y-dev.<short-sha> and moving X.Y-dev tags to GHCR and Docker Hub.
Report build status to Discord and document the release branch tags.
- Hide proxy configuration contents from users without update permission.
- Select and validate backup S3 storage against the resource's team.
- Keep scheduled branch syncs green while a conflict PR remains open.
- Document external mount permissions and Sentinel traffic limits.
- Add regression coverage for authorization and backup storage selection.
peaklabs-dev
Andras BacsaiandClaude Opus 5.5