Hongming Wang 33eb629c16 ci(promote-latest): workflow_dispatch to retag :staging-<sha> → :latest ... Escape hatch for the initial rollout window (canary fleet not yet provisioned, so canary-verify.yml's automatic promotion doesn't fire) AND for manual rollback scenarios. Uses the default GITHUB_TOKEN which carries write:packages on repo- owned GHCR images, so no new secrets are needed. crane handles the remote retag without pulling or pushing layers. Validates the src tag exists before retagging + verifies the :latest digest post-retag so a typo can't silently promote the wrong image. Trigger from Actions → promote-latest → Run workflow → enter the short sha (e.g. "4c1d56e"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-19 05:42:48 -07:00
..
workflows	ci(promote-latest): workflow_dispatch to retag :staging-<sha> → :latest	2026-04-19 05:42:48 -07:00