[flowcool]

Problem

Stable promotion copies the qualified RC image. The container therefore kept reporting the RC tag as its build version after promotion.

Result

• Derive target software version X.Y.Z and full source commit from validated release metadata.
• Embed APP_VERSION and APP_REVISION in both native builds.
• Use pinned docker/metadata-action for OCI metadata generation.
• Report ghostfolio-ibkr-sync version X.Y.Z — commit <12-char SHA> at startup and per application cycle.
• Verify target and legacy image identity before digest promotion.
• Keep old qualified RC images recoverable without changing their bytes.
• Archive and sync the OpenSpec change.

Validation

• 90 targeted tests passed.
• 28 release identity tests passed.
• Ruff and mypy passed.
• Release workflow YAML parsed successfully.
• Isolated Docker image build and runtime identity check passed.
• OpenSpec strict validation passed.
• Full suite was attempted but stopped after five minutes without assertion progress while another Docker build used the shared engine; no failing assertion was observed.

No registry, lab, or production action is part of this PR.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: flowcool/ghostfolio-ibkr-sync
• Branch: automate-release-version-identity
• File: .coderabbit.yaml
• Commit: 24c3460
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4131cf1c-a3f4-4c98-b62f-0cd4dec226d8

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

ℹ️ No critical issues — one mislabeled action pin inline.

Reviewed changes

Reviewed the full PR: automatic X.Y.Z + full-commit identity embedded at build time, reported at startup, and verified before publication and promotion.

• Release identity derivation — release_identity() maps a validated stable or RC tag to X.Y.Z and refuses a non-40-hex commit. Preflight emits app_version/revision only after confirming the checkout matches the tag.
• Shared identity verifier — verify_image_identity() returns target or legacy. It rejects duplicate APP_* env entries, mixed forms and runtime/OCI disagreement. Promotion also requires both architectures to share one form before any write.
• Native build inputs — both build-push-action calls receive identical APP_VERSION/APP_REVISION and OCI labels. The explicit labels override the duplicate metadata-action keys with equal values.
• Runtime gate — check_container_runtime.sh checks the immutable image config and greps the exact startup line in one-off, scheduled and real-app paths. Unlabeled CI images still pass through the dev/unknown branch.
• Startup output — entrypoint.sh and app.main print the same version X — commit <12> line and fall back to unknown for a malformed revision.

No financial, import, cash or Ghostfolio request helper is touched, so no downstream DEGIRO propagation is needed. Nothing in the diff could log a credential.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using claude-opus-5-5 ｜ 𝕏}