feat(release): rebuild stable images from reviewed draft releases

Add manual fix-release validation and stable image rebuilds, inject traceable development versions into SHA builds, and suppress invalid release links for development versions.

tests/Unit/ProductionImageWorkflowTest.php

@@ -1,37 +1,62 @@
 <?php
 
-it('publishes v4 branch builds only under the commit sha', function () {
+it('publishes v4 branch builds under the commit sha with a traceable internal version', function () {
     $workflow = file_get_contents(dirname(__DIR__, 2).'/.github/workflows/coolify-sha-build.yml');
+    $dockerfile = file_get_contents(dirname(__DIR__, 2).'/docker/production/Dockerfile');
+    $constants = file_get_contents(dirname(__DIR__, 2).'/config/constants.php');
 
     expect($workflow)
         ->toContain('name: Build Coolify (SHA)')
         ->toContain('sha-${{ github.sha }}-${{ matrix.arch }}')
         ->toContain('sha-${{ github.sha }}')
-        ->not->toContain('bootstrap/getVersion.php')
-        ->not->toContain('steps.version.outputs.VERSION')
-        ->not->toContain('IMAGE_NAME }}:latest');
+        ->toContain('php bootstrap/getVersion.php')
+        ->toContain('version=${BASE_VERSION}-dev.${GITHUB_SHA::9}')
+        ->toContain('COOLIFY_VERSION=${{ steps.version.outputs.version }}')
+        ->not->toContain('IMAGE_NAME }}:latest')
+        ->and($dockerfile)
+        ->toContain('ARG COOLIFY_VERSION')
+        ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
+        ->and($constants)
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.0'");
 });
 
-it('promotes the released commit image without rebuilding it', function () {
+it('orders a maintenance development build before its stable release', function () {
+    expect(version_compare('4.3.0-dev.d64cbda3e', '4.3.0', '<'))->toBeTrue()
+        ->and(version_compare('4.3.0', '4.3.0-dev.d64cbda3e', '>'))->toBeTrue();
+});
+
+it('requires a reviewed draft release before building a stable version', function () {
     $workflow = file_get_contents(dirname(__DIR__, 2).'/.github/workflows/coolify-release.yml');
 
     expect($workflow)
-        ->toContain('release:')
-        ->toContain('types: [published]')
-        ->toContain('TAG_NAME: ${{ github.event.release.tag_name }}')
-        ->toContain('git rev-list -n 1 "${TAG_NAME}"')
-        ->toContain('SOURCE_TAG="sha-${RELEASE_SHA}"')
+        ->toContain('workflow_dispatch:')
+        ->toContain('tag:')
+        ->toContain('github.ref_name != \'v4.x\'')
+        ->toContain('github.paginate(github.rest.repos.listReleases')
+        ->toContain('release.draft')
+        ->toContain('release.prerelease')
+        ->toContain('release.body?.trim()')
         ->toContain('bootstrap/getVersion.php')
-        ->toContain('--tag "${IMAGE}:${VERSION}"')
-        ->not->toContain('docker/build-push-action');
+        ->toContain('target_commitish: context.sha')
+        ->not->toContain('generate-notes');
 });
 
-it('only promotes stable releases to latest', function () {
+it('rebuilds stable images and publishes the reviewed draft after both architectures succeed', function () {
     $workflow = file_get_contents(dirname(__DIR__, 2).'/.github/workflows/coolify-release.yml');
 
     expect($workflow)
-        ->toContain('if: ${{ ! github.event.release.prerelease }}')
-        ->toContain('--tag "${IMAGE}:latest"');
+        ->toContain('docker/build-push-action@v6')
+        ->toContain('COOLIFY_VERSION=${{ needs.validate.outputs.version }}')
+        ->toContain('release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}')
+        ->toContain('--tag "${IMAGE}:${VERSION}"')
+        ->toContain('--tag "${IMAGE}:latest"')
+        ->toContain('github.rest.repos.getRelease')
+        ->toContain('release.target_commitish !== context.sha')
+        ->toContain('release_id: Number(process.env.RELEASE_ID)')
+        ->toContain('draft: false')
+        ->toContain('permissions: {}')
+        ->not->toContain('sarisia/actions-status-discord@v1')
+        ->not->toContain('SOURCE_TAG="sha-${RELEASE_SHA}"');
 });
 
 it('documents the sha image release process', function () {
@@ -46,10 +71,13 @@ it('documents the sha image release process', function () {
         ->toContain('Merge the release commit into `v4.x`')
         ->toContain('`Build Coolify (SHA)`')
         ->toContain('`sha-<commit-sha>`')
-        ->toContain('targeting the exact commit that produced the SHA image')
-        ->toContain('promotes the existing SHA image without rebuilding it')
+        ->toContain('Create a reviewed draft GitHub release')
+        ->toContain('rebuilds AMD64 and ARM64 images with the exact stable version')
+        ->toContain('publishes the existing draft release')
         ->toContain('Update the CDN')
         ->toContain('Only commits on **`v4.x`** produce production SHA images')
+        ->not->toContain('`edge`')
+        ->not->toContain('promotes the existing SHA image')
         ->not->toContain('Merging to `main`')
         ->not->toContain('Production Build (v4)');
 });