- Remove push-to-main trigger; only tag push publishes images
- Prerelease tags (e.g. v0.1.0-beta.2) publish their version tag
only, without updating latest or short semver tags
Run migrate up -> down -> up against a temporary PostgreSQL service
container on every PR and push to main, verifying all migrations
apply, rollback, and re-apply correctly.
Add dedicated docker-publish.yml with full CI/CD pipeline:
- Build & push server/agent/web/mcp images on tag, main push, and PR
- Publish to both Docker Hub and GHCR
- Semver tag strategy (latest, version, major.minor, major, sha)
- GHA build cache, SLSA provenance, and SBOM
- PR builds validate without pushing
Remove superseded dockerhub job from release.yml.
BBQ