Description
The 2026-09-07 wave published ghcr.io/rknightion/synthkit-skcapture through the shared container-publish reusable (v1.21.0, image-name input) on edge builds only: the skcapture-image job in .github/workflows/publish.yml is gated if: inputs.release_tag == ‘’ and deploy/skcapture/job.yaml pins main-63c183a. An operator following a release therefore has no versioned skcapture reference to match the synthkit release they run. Extend publish.yml so a release_tag run also publishes synthkit-skcapture at that tag, and extend verify-release so it verifies the second image’s exact platform digests, signature and provenance without breaking its existing exactly-two-digests assertion for the main image (the reusable namespaces named-image digest artifacts as image-image-digests-*). Then point deploy/skcapture/job.yaml and docs/tools.md at the release form with the edge form documented as the development override.
Acceptance Criteria
- #1 A release_tag publish run produces ghcr.io/rknightion/synthkit-skcapture:
with signature and provenance, pasted from the run - #2 verify-release checks both images’ exact digests and still passes for the main image unchanged
- #3 deploy/skcapture/job.yaml and docs/tools.md reference the release form, with the edge form documented as the development override
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Extend the existing publish workflow for both image artifacts and verifications, validate with actionlint and zizmor, and prove unchanged edge publication. Release PR remains open, so release-tag criteria remain unproven until the next release. Keep a runnable existing Job pin until an actual release image exists; document the release form and development override.
Wave 2026-09-09: merge the authorized release PR after green checks, verify the stable release and both images, pin the capture Job and operator docs to the stable tag, then run the final gate and reconcile AC3.
Implementation Notes
2026-09-06: source integrated at f7bb4a275994dd3c0a228a35c88a56cf1497ac09. Edge publish run 34038183725 completed success: both images built for both architectures, merged and signed. Release-only verification was skipped, not passed. Actionlint and zizmor succeeded at this SHA; CodeRabbit terminal complete with zero findings. The root local just check, explicit safe/native dumps and one agent-excluded just e2e passed; generation was not needed for this workflow/docs-only lane. AC1 remains unproven until a real release; AC2 remains unproven because exact digest-count/index/signature/provenance logic has not run in release mode. AC3 remains open: release-form guidance landed, but both Job containers retain the proven edge image until an actual release image exists. Release PR #100 remains open. Resume at the next release, inspect both exact digest sets and verifications, then update both Job image references to that proven release. CI had one known parallel-isolation timing failure; the authorized unchanged-SHA retry is running.
CI run 34038183714 attempt 2 completed success at unchanged f7bb4a275994dd3c0a228a35c88a56cf1497ac09. The first attempt failed TestRunParallelIsolation under coverage; the single authorized retry passed Go and e2e. The first failure is retained as evidence, not erased.
Correction from new automatic publication evidence, 2026-09-06: existing auto-rc workflow 34044677795 dispatched release_tag v1.4.0-rc.105 at ceeed36897cc4eab3ad933d2139d2d074456e620. Publish 34044719283 and its verify-release job succeeded, including both exact platform-digest downloads, both signature/provenance checks, and published Compose. Main index sha256:5b6610dd4360963111eaef6f870de142a275864038bb21a1fcdb1151133bdbbe; capture index sha256:50e8e1f35b89933fa9e7081c636b2130f77205fb25b34c4222395d3bf724e149. This is actual release_tag execution on an automatic prerelease, superseding the earlier source-only statement and proving AC1/2. Root dispatched no release and did not touch PR100. The task remains Parked/open: the shipped Job remains on its proven edge pin pending a stable release pin, so AC3 stays unchecked. Docs and manifest comments now distinguish that remaining boundary from the proven prerelease path.
2026-09-09 stable-release closeout: release-please created v1.4.0 after the authorized merge and the tag publish verified both images. The shared publisher normalizes the container tag to 1.4.0; v1.4.0 is the Git release tag and does not resolve as a container tag. Both Job containers and operator docs now pin ghcr.io/rknightion/synthkit-skcapture:1.4.0, with main-
Final Summary
Release-image source and operator guidance landed; edge publication is proven unchanged. Parked with all release-dependent acceptance criteria open until the next release and a concrete release image pin. No release was requested or performed.
Stable 1.4.0 release publication is verified for both images, and the shipped skcapture Job plus operator docs now use the published 1.4.0 container tag.