fix(release): keep GHCR latest on stable images

Publish prerelease self-hosted Web images under explicit version and SHA tags while reserving the mutable GHCR latest alias for stable tag refs.

Refs:
- Change: spec/changes/active/release-0-6-0-version-alignment
- Trace: FR-REL-003 / DES-REL-004 / TEST-REL-006 / T-REL-006

Verification:
- focused workflow regression: red then 2/2 passed
- pnpm verify:release: 42/42 passed
- pnpm spec:traceability: passed
- git diff --check: passed

Author: legeling

.github/workflows/web-self-hosted.yml

@@ -84,7 +84,7 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern=v{{version}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
+            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}
             type=ref,event=tag
             type=sha
 

apps/desktop/tests/unit/scripts/web-self-hosted-workflow.test.ts

@@ -15,12 +15,15 @@ const webPackage = JSON.parse(
 ) as { version: string };
 
 describe("self-hosted Web release workflow", () => {
-  it("publishes Web images from the standard Desktop release tag", () => {
+  it("publishes versioned Web images from release tags without moving stable latest for prereleases", () => {
     expect(workflowSource).toContain('- "packages/core/**"');
     expect(workflowSource).toContain('- "v*"');
     expect(workflowSource).toContain("type=semver,pattern={{version}}");
     expect(workflowSource).toContain("type=semver,pattern=v{{version}}");
     expect(workflowSource).toContain(
+      "type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-') }}",
+    );
+    expect(workflowSource).not.toContain(
       "type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}",
     );
   });

docs/web-self-hosted.md

@@ -167,12 +167,17 @@ Useful root-level commands:
 
 `apps/web` already includes a production `Dockerfile` and ready-to-use compose files.
 
-When a standard `v<version>` release tag is built in CI, PromptHub also
-publishes a container image to GHCR:
+When a `v<version>` release tag is built in CI, PromptHub also publishes a
+container image to GHCR:
 
 - `ghcr.io/legeling/prompthub-web:<version>`
 - `ghcr.io/legeling/prompthub-web:v<version>`
-- `ghcr.io/legeling/prompthub-web:latest`
+- `ghcr.io/legeling/prompthub-web:latest` for stable tags only
+
+Prerelease tags such as `v0.6.0-beta.1` publish their explicit versioned image
+without moving `latest`. Use the explicit prerelease tag for manual beta
+testing; production deployments that track `latest` remain on the latest
+stable image.
 
 ### Quick Start with Docker Compose
 
@@ -210,6 +215,8 @@ multiple containers against the same data volume.
 
 ### Deploy from the Published GHCR Image
 
+The `latest` alias below tracks stable releases only.
+
 ```bash
 docker pull ghcr.io/legeling/prompthub-web:latest
 docker run -d \

spec/changes/active/release-0-6-0-version-alignment/design.md

@@ -28,6 +28,15 @@ Add a `0.6.0` release record with `Preparation` status and an `Unreleased`
 changelog summary. Do not change localized README stable badges or fixed
 download links until publication.
 
+## `DES-REL-004`: Stable GHCR Alias Isolation
+
+The Self-Hosted Web tag workflow always publishes immutable prerelease tags
+such as `0.6.0-beta.1`, `v0.6.0-beta.1`, the source tag, and commit SHA. It
+publishes the mutable `latest` alias only when `github.ref_name` has no semver
+prerelease suffix. The decision is constant-time string classification and does
+not change image contents, build inputs, registry authentication, or the
+stable-versioned tags already present in GHCR.
+
 ## Affected Areas
 
 - Data model: none
@@ -68,3 +77,4 @@ download links until publication.
 | `FR-REL-001`  | `DES-REL-001`                | `TEST-REL-001`                                 | `T-REL-001`              |
 | `FR-REL-002`  | `DES-REL-002`, `DES-REL-003` | `TEST-REL-002`, `TEST-REL-003`, `TEST-REL-005` | `T-REL-002`, `T-REL-003` |
 | `NFR-REL-001` | `DES-REL-002`                | `TEST-REL-003`, `TEST-REL-004`                 | `T-REL-002`              |
+| `FR-REL-003`  | `DES-REL-004`                | `TEST-REL-006`                                 | `T-REL-006`, `T-REL-007` |

spec/changes/active/release-0-6-0-version-alignment/implementation.md

@@ -16,6 +16,13 @@
 - The `0.6.0` preparation record and unreleased changelog note are synchronized.
 - Public website badges, introduction copy, and download URLs remain on the
   published `0.5.9` stable release.
+- During the `v0.6.0-beta.1` replacement, the first Self-Hosted Web run was
+  cancelled before its Docker job because the existing any-`v*` metadata rule
+  would also publish the mutable GHCR `latest` alias. No beta image was pushed
+  by that cancelled run.
+- The GHCR metadata rule now emits `latest` only for a tag ref whose ref name
+  has no prerelease suffix. Beta images retain explicit semver, source-tag and
+  commit-SHA tags.
 
 ## Verification
 
@@ -51,6 +58,21 @@
     lines each, above the preferred 1500-line limit. All shared, database, core,
     CLI, Desktop, Web, Worker, and Mobile typecheck/test/lint checks in the
     profile passed.
+- `TEST-REL-006` first failed against the any-`v*` raw `latest` rule, then
+  passed after the stable-ref guard was added. The cancelled Web run completed
+  Web verification and Docker Compose validation; its Docker metadata and
+  build-push steps never started.
+- The corrected candidate passed `pnpm verify:release` with 42/42 checks, zero
+  failed or blocked checks, and a maximum concurrency of two. Performance,
+  Desktop unit/integration/build/bundle/E2E, CLI/Web builds, Web smoke,
+  Cloudflare dry-run and Mobile gates all passed.
+- Read-only GHCR inspection confirmed the pre-existing `latest` alias still
+  points at withdrawn beta revision `2ed96c7f` with manifest digest
+  `sha256:c9b4c4f3b7a463146685144a4f4f4b8ef23e2b07c5d16c9d51a9c1e2fcd33664`.
+  The explicit stable `0.5.9` image remains available at digest
+  `sha256:e8d6214030a27090a443ca38d4b5f07d4331af09d9a20b71e5138090bd8a2e40`;
+  `T-REL-007` must restore `latest` to that stable image before beta
+  publication completes.
 
 ## Analyze
 
@@ -81,5 +103,8 @@ this change has no visible product UI delta.
 
 ## Follow-ups
 
-- Tagging, signing, artifact publication, and remote verification are separate
-  publication tasks and are not performed by this version-alignment change.
+- Complete `T-REL-006` and retag the replacement candidate, then verify the
+  versioned beta image is present while stable `latest` keeps the `0.5.9`
+  manifest digest.
+- Desktop signing, artifact publication, and promotion remain governed by the
+  `v0.6.0-beta.1` replacement release change.

spec/changes/active/release-0-6-0-version-alignment/proposal.md

@@ -27,6 +27,8 @@ advertising nonexistent `0.6.0` downloads.
   - record `0.6.0` as a release preparation
   - keep public stable downloads and badges on the latest explicit stable
     release record
+  - publish prerelease Web images under versioned GHCR tags without moving the
+    stable `latest` image
   - verify the explicit public stable release boundary
 - Out of scope:
   - creating or pushing a `v0.6.0` tag
@@ -38,6 +40,8 @@ advertising nonexistent `0.6.0` downloads.
 
 - A missed product manifest could produce artifacts with inconsistent versions.
 - Premature website synchronization could create broken `0.6.0` download links.
+- A prerelease tag could overwrite GHCR `latest` and silently move stable
+  self-hosted deployments onto a beta image.
 - The dirty worktree contains unrelated feature work; release edits must remain
   isolated and must not rewrite those files.
 

spec/changes/active/release-0-6-0-version-alignment/specs/release/spec.md

@@ -34,6 +34,17 @@ Release metadata selection must scan the release index and changelog linearly,
 use bounded working memory, and fail explicitly when the published stable
 record or its dated changelog entry is missing.
 
+### `FR-REL-003`: Prerelease GHCR Isolation
+
+Self-Hosted Web prerelease tags MUST publish versioned GHCR images without
+moving the mutable stable `latest` alias.
+
+#### `AC-REL-004`
+
+Given a tag such as `v0.6.0-beta.1`, the workflow emits prerelease-version and
+commit-specific image tags but does not emit `latest`. Given a stable tag such
+as `v0.6.0`, the same workflow emits `latest` in addition to versioned tags.
+
 ## Verification
 
 - `TEST-REL-001`: assert all authoritative product manifests equal `0.6.0`.
@@ -45,3 +56,5 @@ record or its dated changelog entry is missing.
   entries fail explicitly.
 - `TEST-REL-005`: run website synchronization and verify generated public
   metadata remains on the latest published stable version.
+- `TEST-REL-006`: assert the Self-Hosted Web workflow gates the raw `latest`
+  image tag on a stable ref name and rejects the previous any-`v*` condition.

spec/changes/active/release-0-6-0-version-alignment/tasks.md

@@ -15,3 +15,8 @@
       actual results and residual release risks.
 - [x] `T-REL-005` Complete converge records; keep the change active until
       `0.6.0` publication is complete.
+- [x] `T-REL-006` Add the failing GHCR prerelease-isolation regression, then
+      restrict the mutable `latest` alias to stable tag refs (`FR-REL-003`,
+      `DES-REL-004`, `TEST-REL-006`).
+- [ ] `T-REL-007` Verify the corrected tag workflow publishes beta-versioned
+      images without changing stable `latest`, then record remote evidence.