Nothing builds the container image until a tag exists, so a broken Dockerfile is invisible until the moment it matters most.
Current state: ci.yml runs test, frontend, lint, vuln and sdk-compat. None of them touches the Dockerfile. Only release.yml builds an image, and it runs on a pushed tag. Dropping the patches directory in #53 left COPY patches ./patches behind, every gate stayed green, the pull request merged, and 0.11.0 failed at the release build with the tag already pushed.
Proposal: add a build only job to ci.yml that builds the image and pushes nothing. The failure above takes seconds to catch and needs no registry credentials.
Trigger: already fired, it broke the 0.11.0 release.
Nothing builds the container image until a tag exists, so a broken Dockerfile is invisible until the moment it matters most.
Current state:
ci.ymlruns test, frontend, lint, vuln and sdk-compat. None of them touches the Dockerfile. Onlyrelease.ymlbuilds an image, and it runs on a pushed tag. Dropping thepatchesdirectory in #53 leftCOPY patches ./patchesbehind, every gate stayed green, the pull request merged, and 0.11.0 failed at the release build with the tag already pushed.Proposal: add a build only job to
ci.ymlthat builds the image and pushes nothing. The failure above takes seconds to catch and needs no registry credentials.Trigger: already fired, it broke the 0.11.0 release.