ci: Fix release artifact publication

[timflannagan]

Description

Clean up the release pipeline so stable releases have one supported entry
point: pushing a vX.Y.Z tag for a commit on main. The workflow validates
the tag before publication and builds both container images directly in GHCR
instead of targeting the local development registry.

Align the Helm chart with the published artifacts by retaining X.Y.Z as the
chart version while using vX.Y.Z for the application version and default
server image. Add a maintainer runbook covering the published artifacts,
tagging the freshly fetched origin/main revision, verification, and retry
behavior.

Change Type

/kind cleanup

Changelog

NONE

Additional Notes

Manual workflow dispatch is intentionally removed so the current release
process cannot publish an incomplete release without its Git tag and GitHub
Release. A future release-pipeline refactor can make dispatch the sole entry
point while having the workflow own tag creation.

Verified with make charts-test CHART_VERSION=0.4.0 (105 tests),
make charts-lint CHART_VERSION=0.4.0, and make release-cli VERSION=v0.4.0.
All five CLI targets cross-compile successfully, the chart renders
server:v0.4.0 with chart version 0.4.0 and application version v0.4.0,
and Docker build dry runs resolve both images under
ghcr.io/agentregistry-dev/agentregistry.

[Copilot]

🟡 Not ready to approve

Manual workflow dispatch can still publish mismatched tags if the provided version lacks the required leading v (see stored comment on normalizing/validating VERSION).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR fixes the GitHub Actions release pipeline to publish container images to GHCR (instead of the local dev registry), aligns the Helm chart’s default image tag and appVersion with the vX.Y.Z release image tags, and documents the end-to-end release procedure (artifacts, verification, recovery).

Changes:

• Update the release workflow to publish images to ghcr.io and require an explicit version for manual dispatch; remove the Helm registry logout step.
• Align Helm chart appVersion/default image tag expectations to vX.Y.Z and update chart tests/metadata accordingly.
• Add and cross-link release documentation from existing governance/development/contributing docs.

File summaries

File	Description
docs/releasing.md	New canonical release procedure documentation (artifacts, verification, retry/recovery).
docs/governance/cncf/technical-review.md	Adds a link to the new release procedure documentation.
DEVELOPMENT.md	Points readers to the canonical release procedure doc from the Helm pipeline section.
CONTRIBUTING.md	Replaces inline release steps with a link to the canonical release procedure doc.
charts/agentregistry/tests/deployment_test.yaml	Updates test expectation to require a v-prefixed default image tag.
charts/agentregistry/Chart-template.yaml	Sets appVersion to v${CHART_VERSION} and aligns Artifact Hub image annotation tag format.
.github/workflows/release.yaml	Fixes build registry to GHCR, requires manual version input, and removes Helm logout.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[Copilot]

🟡 Not ready to approve

The PR description claims manual dispatch behavior that the updated release workflow no longer supports, and there is also a small grammar fix needed in the documentation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (2)

.github/workflows/release.yaml:11

• The PR description says “Manual dispatch now requires an explicit version”, but this workflow no longer defines a workflow_dispatch trigger at all (it only runs on pushed tags). Please update the PR description to match the implemented behavior, or reintroduce workflow_dispatch if manual releases are still required.

on:
  push:
    tags:
    - "v*.*.*"

env:
  VERSION: ${{ github.ref_name }}
  DOCKER_REGISTRY: ghcr.io
  DOCKER_BUILD_REGISTRY: ghcr.io

docs/governance/cncf/technical-review.md:163

• Minor grammar: “artifact” should be plural here since the sentence refers to multiple procedures/artifacts.

The tagging, publication, artifact, verification, and recovery procedures are

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[timflannagan]

Was tempted to emulate https://github.com/kgateway-dev/kgateway/blob/467617fbaeae1a4aa14a271657391a64bc77866a/.github/workflows/release.yaml#L100 but this is fine for now

[timflannagan]

Before I forget myself, needed as the Makefile itself splits up these variables. Should simplify later

[Copilot]

🟡 Not ready to approve

CONTRIBUTING.md now describes releases as coming from an “annotated SemVer tag”, which is ambiguous vs the required vX.Y.Z tag format used elsewhere and could mislead maintainers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

CONTRIBUTING.md:278

• This section says releases are published from an "annotated SemVer tag", but elsewhere in the docs and the release workflow the required tag format is explicitly vX.Y.Z. Calling it a SemVer tag can be read as X.Y.Z (no v), which would not trigger the release workflow and would conflict with the runbook.

Maintainers should follow the complete [release process](docs/releasing.md).
Releases are built and published by GitHub Actions from an annotated SemVer
tag on `main`.

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[timflannagan]

🟡 Not ready to approve

CONTRIBUTING.md now describes releases as coming from an “annotated SemVer tag”, which is ambiguous vs the required vX.Y.Z tag format used elsewhere and could mislead maintainers.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Review details

Suppressed comments (1)

CONTRIBUTING.md:278

• This section says releases are published from an "annotated SemVer tag", but elsewhere in the docs and the release workflow the required tag format is explicitly vX.Y.Z. Calling it a SemVer tag can be read as X.Y.Z (no v), which would not trigger the release workflow and would conflict with the runbook.

Maintainers should follow the complete [release process](docs/releasing.md).
Releases are built and published by GitHub Actions from an annotated SemVer
tag on `main`.

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

Insane