ci(release): support prerelease self-host image tags

[JSONbored]

Summary

• The release-orb workflow accepted strict X.Y.Z semver only, while a beta/RC posture needs a prerelease image tag (orb-v0.1.0-rc.1 / orb-v0.1.0-beta.1) rather than an overclaiming stable orb-v0.1.0.

Scope

• .github/workflows/release-selfhost.yml:
  • Widened the "Resolve version" step's regex to accept an optional -rc.N / -beta.N suffix and compute a new prerelease output.
  • New "Resolve image tags" step: builds the docker/metadata-action tags list in bash instead of a static multi-line literal, so latest is only included for a stable version — a prerelease build is pushed under its own version tag + sha only, never latest.
  • "GitHub Release" step: passes --prerelease --latest=false to gh release create/edit only when PRERELEASE=true, so the release is visibly marked prerelease and never becomes the repo's "Latest release". Stable release behavior (both flags omitted) is unchanged.
• apps/gittensory-ui/src/routes/docs.self-hosting-releases.tsx — documented the prerelease tag policy: which tag beta testers should pull, and that latest/GitHub Release marking stays untouched for stable tags.
• Tests: 15 new tests in test/unit/release-selfhost-prerelease.test.ts execute the ACTUAL bash extracted from the committed workflow YAML against a real GITHUB_OUTPUT file (not a re-derived copy), covering stable/rc/beta/workflow_dispatch acceptance, rejection of malformed versions and unsupported prerelease kinds (e.g. -alpha), and the tags/GitHub-Release steps' prerelease branching. Updated one pre-existing assertion in test/unit/selfhost-sentry-release.test.ts that string-matched the old inline tags literal.

Validation

• npx vitest run test/unit/release-selfhost-prerelease.test.ts test/unit/selfhost-sentry-release.test.ts — 17/17 passing
• npm run actionlint — clean
• npm run typecheck — clean
• npm run test:ci — full local gate green
• npm audit --audit-level=moderate — 0 vulnerabilities

Safety

• Stable release behavior is byte-identical: a plain X.Y.Z tag still resolves prerelease=false, still moves latest, and both gh release calls receive an empty PRERELEASE_ARGS array (no flag change).
• Touches .github/workflows/**, a guarded path — expect this to be held for manual owner merge rather than auto-merged.

Closes #1937

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 12:53:51 UTC}

4 files · 1 AI reviewer · no blockers · readiness 98/100 · CI pending · blocked

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
The change coherently widens the self-host release workflow to accept rc/beta prerelease tags, derives a prerelease output once, and uses it to keep prerelease images off `latest` while marking GitHub Releases correctly. The new unit tests execute the committed workflow bash for version and tag resolution, so the most important release-branching behavior is covered against the real source instead of a copied implementation. I do not see a reachable correctness break in the provided files.

Nits — 7 non-blocking

• nit: `.github/workflows/release-selfhost.yml:73` allows prerelease numeric identifiers like `rc.0`; confirm that is intentional, or tighten the regex if release numbering should start at 1.
• nit: `test/unit/release-selfhost-prerelease.test.ts:126` only string-checks the GitHub Release bash instead of executing the prerelease argument branch, so this is weaker than the real-bash coverage used for version and image-tag resolution.
• nit: `apps/gittensory-ui/src/routes/docs.self-hosting-releases.tsx:43` uses all-caps `STABLE`, which reads louder than the surrounding docs style.
• Add one malformed-version case for `0.1.0-rc.0` if zero-indexed prereleases are not part of the intended contract.
• Consider extracting just the `PRERELEASE_ARGS` computation from `.github/workflows/release-selfhost.yml` into an executable test harness, matching the stronger pattern used for `Resolve version` and `Resolve image tags`.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#1937
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:S; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 55 merged, 536 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 65 PR(s), 536 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 536 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• No action.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.02%. Comparing base (612969d) to head (7245db3).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2610   +/-   ##
=======================================
  Coverage   96.02%   96.02%           
=======================================
  Files         233      233           
  Lines       26077    26077           
  Branches     9474     9474           
=======================================
  Hits        25041    25041           
  Misses        425      425           
  Partials      611      611           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	7245db3	Commit Preview URL Branch Preview URL	Jul 02 2026, 01:08 PM