Releases, packages and Pages
Specmate follows WireHub's separation between source CI, release automation, images, and the static docs/helper site. Versioned publication does not deploy the application on an operator's machine.
Workflows
| Workflow | Trigger | Result |
|---|---|---|
ci.yml |
Main push, pull request, manual run; reusable verification call | Frozen Bun tooling, selected application checks, all 29 independent reusable-package lifecycles, engineering service contracts, actual Node image/install and authenticated synthetic engineering browser workflow. No image publication. |
release-please.yml |
Main push or manual run | Maintains a Conventional Commit release PR with version/changelog changes. Merge creates a vX.Y.Z release and calls the image workflow directly. |
image.yml |
Published release, reusable call from release automation, or manual test build | Re-verifies the selected source, then publishes ghcr.io/formless63/specmate for amd64 and arm64. Manual tags are edge or test-<name>; they cannot replace latest or version tags. |
pages.yml |
Main changes to docs/site/install inputs, or manual run | Builds/tests and deploys the static homepage, public docs and browser-only install helper. It does not host the Node app, database or worker. |
Stable release images get X.Y.Z, X.Y, latest, and X once the major version is at least 1. Prereleases do not move latest. Prefer exact version/digest references for reproducible installs. Images contain the same Node app, ordinary worker and migration bundles; a separate app/worker GHCR package is unnecessary. No npm application package is published.
Release Please starts from manifest 0.0.0; the first release PR determines the initial public version. Its GitHub-token-created release calls the image workflow explicitly because such token events do not start downstream workflows. Review the release PR before merging; source/tests alone do not establish physical or production qualification.
Repository settings
For Release Please, allow GitHub Actions to create pull requests under Settings → Actions → General → Workflow permissions. The workflows request only their own required permissions. A PR created using GITHUB_TOKEN does not automatically trigger another workflow; manually run CI against its branch before merging, or use a separately configured approved GitHub App token if automatic release-PR CI is desired.
For Pages, select GitHub Actions as the publishing source under Settings → Pages. The site is intended for https://formless63.github.io/specmate/; relative links and downloads support the repository subpath. Public site builds use an allowlist of public documentation, not internal planning or machine context.
GHCR package visibility is separate from repository visibility. After the first image publication, verify that the specmate container package is public, associated with this repository, and anonymously pullable. A successful authenticated workflow push does not prove an unauthenticated installer can pull it. Keep tokens out of deployment files.
Operator source and notices
The image's /source/ page offers its exact build context and installed dependency sources/license files as corresponding-source.tar.gz. The Docker build excludes credentials, ignored designs, private planning and Git metadata. The app visibly links this source offer; OCI metadata records the repository, revision, version and core license. Package and asset notices retain their own terms. See Licensing.
The image does not contain native KiCad/OpenSCAD tool installations. An isolated CAD tool-worker image or environment needs its own tool/asset rights and engineering verification. A published application image does not enable hardware operation.