ci(release): qualify supported self-hosted platforms

[FelixTJDietrich]

Description

Define the supported self-hosted matrix as native Ubuntu 24.04 on amd64 and arm64, then make every release prove both cells before publication. Each smoke job verifies the signed release lock, boots the documented Compose topology, checks HTTPS ingress, and publishes a release- and commit-bound status record; the publish job rejects missing, duplicate, unhealthy, or failed-service evidence.

This keeps the support promise deliberately narrow and gives operators durable qualification evidence instead of making the first ARM64 installation an unplanned test.

The generated web client is also refreshed with the repository's pinned generator because the API drift gate detected stale generated imports. The OpenAPI contract is unchanged.

Fixes #1605

How to test

• bun run format
• bun run check
• bun run verify
• The next release cut will exercise the two native host jobs against that release's immutable images; either failure must leave the release in draft.

Checklist

• The empty changeset explains why the generator-only client refresh has no release note.
• No operator migration or new required environment variable is introduced.

[coderabbitai]

Warning

Review limit reached

Next included review available in 14 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 42eaacee-356a-4f8c-8cc7-e8f3bf6d9fe6

📥 Commits

Reviewing files that changed from the base of the PR and between ca1503c and 978ef31.

📒 Files selected for processing (16)

• .changeset/curvy-corners-heal.md
• .github/workflows/release.yml
• scripts/release-deployment-policy.test.ts
• webapp/src/api/@tanstack/react-query.gen.ts
• webapp/src/api/client.gen.ts
• webapp/src/api/client/client.gen.ts
• webapp/src/api/client/index.ts
• webapp/src/api/client/types.gen.ts
• webapp/src/api/client/utils.gen.ts
• webapp/src/api/core/bodySerializer.gen.ts
• webapp/src/api/core/serverSentEvents.gen.ts
• webapp/src/api/core/types.gen.ts
• webapp/src/api/core/utils.gen.ts
• webapp/src/api/index.ts
• webapp/src/api/sdk.gen.ts
• webapp/src/api/transformers.gen.ts

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 05079852-808d-4c5e-b332-6a3e10a00ec1

📥 Commits

Reviewing files that changed from the base of the PR and between bac46c1 and ca1503c.

📒 Files selected for processing (4)

• .github/workflows/release.yml
• docs/admin/install.mdx
• docs/contributor/release-management.mdx
• scripts/release-deployment-policy.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow now qualifies native Ubuntu 24.04 amd64 and arm64 hosts. It validates Docker and Compose versions, runs the self-host install, records service health, and blocks publication unless both records pass validation.

Changes

Supported host qualification

Layer / File(s)	Summary
Supported host matrix contract docs/admin/install.mdx, docs/contributor/release-management.mdx	The documentation defines native Ubuntu 24.04 amd64 and arm64 hosts, Docker version floors, and the supported-host release gate.
Native host smoke execution .github/workflows/release.yml, scripts/release-deployment-policy.test.ts	The workflow tests both architectures, verifies the host environment, starts the stack, checks HTTPS, writes JSON records, and validates the workflow policy.
Release publication gate .github/workflows/release.yml, scripts/release-deployment-policy.test.ts	publish-release requires the smoke job, validates exactly two healthy records, and uploads them to the GitHub Release.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to ca150

This change narrows the documented supported host matrix and adds release qualification gates; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant HostSmoke
  participant DockerCompose
  participant HTTPSIngress
  participant PublishRelease
  ReleaseWorkflow->>HostSmoke: Run amd64 and arm64 smoke tests
  HostSmoke->>DockerCompose: Start stack and wait for readiness
  HostSmoke->>HTTPSIngress: Curl HTTPS endpoint
  HostSmoke-->>PublishRelease: Provide host-smoke JSON records
  PublishRelease->>PublishRelease: Validate both records
  PublishRelease-->>ReleaseWorkflow: Publish release when validation passes

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The pull request satisfies issue #1605. It documents a narrow matrix of native Ubuntu 24.04 hosts with amd64 or arm64 CPUs, Docker Engine 28 or newer, and Docker Compose 2.24.4 or newer. It runs smoke…
Out of Scope Changes check	✅ Passed	The workflow, documentation, release-management guidance, and policy tests directly support the supported-host matrix and release qualification objectives. No unrelated application, container, migrati…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding release qualification for supported self-hosted platforms.

Full details: Linked Issues check

Explanation

The pull request satisfies issue #1605. It documents a narrow matrix of native Ubuntu 24.04 hosts with amd64 or arm64 CPUs, Docker Engine 28 or newer, and Docker Compose 2.24.4 or newer. It runs smoke tests for both architectures, records status evidence, gates publication on both results, and states that hosts outside the matrix are unsupported.

Full details: Out of Scope Changes check

Explanation

The workflow, documentation, release-management guidance, and policy tests directly support the supported-host matrix and release qualification objectives. No unrelated application, container, migration, or environment-variable changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 1605-release-smoke-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)

[github-actions]

🧩 Storybook Preview

Preview has been removed (PR closed)