## What changed?
- Update Go 1.26.0 to 1.26.2
- Run `make update-dependencies` (skipped
`github.com/olekukonko/tablewriter`)
- Updated Docker Alpine version to 3.23.4
## Why?
Address CVEs
## How did you test it?
- [ ] built
- [ ] run locally and tested manually
- [ ] covered by existing tests
- [ ] added new unit test(s)
- [ ] added new functional test(s)
## Potential risks
## What changed?
- Centralized Alpine base image version to a single source of truth in
\`docker/docker-bake.hcl\` (\`ALPINE_TAG\`).
- Updated Docker targets to consume \`ALPINE_TAG\` from bake args
(removed duplicated Dockerfile defaults).
- Updated build action handling so an empty \`alpine-tag\` input does
not override bake defaults.
- Simplified manual Docker workflow inputs by removing platform/snapshot
toggles and hardcoding snapshot builds + multi-arch behavior for manual
runs.
- Clarified manual workflow input descriptions (\`cli-version\`,
\`alpine-tag\`, and push destination).
## Why?
- Avoid Alpine version drift across multiple files.
- Make manual dispatch safer and less error-prone (empty Alpine input
should use default, not fail with \`alpine:\`).
- Reduce confusing/no-op options in manual workflow while keeping
release behavior unchanged.
## Updating versions
**Alpine base image** — edit the \`ALPINE_TAG\` default in
\`docker/docker-bake.hcl\` (line 41):
```hcl
variable "ALPINE_TAG" {
default = "3.23.3" # <-- change this
}
```
**Temporal CLI** — edit the \`defaultCliVersion\` constant in
\`.github/actions/build-docker-images/scripts/main.go\` (line 17):
```go
// defaultCliVersion should be updated to the latest cli version
const defaultCliVersion = "1.6.1" // <-- change this
```
To pin a different version for a one-off manual run without changing the
default, pass it via the \`cli-version\` workflow dispatch input
instead.
## Validation
- Triggered manual workflow against branch and confirmed branch is
available on upstream.
- Verified bake config resolves default Alpine tag from
\`docker/docker-bake.hcl\`.
## What changed?
Add full commit SHA tags alongside the existing short SHA tags for OSS
`server` and `admin-tools` images. The Docker build action now emits
both tag forms, Docker bake publishes both tags, and the manual Docker
build summary shows the short SHA tag, full SHA tag, and branch tag from
action outputs.
## Why?
This repo has outgrown 7-character SHA uniqueness, so short SHA tags can
collide. Since release engineering automation publishes and consumes
these image tags across workflows, using full SHAs keeps artifact
selection deterministic while preserving short tags for compatibility.
## How did you test it?
- [x] built
- [ ] run locally and tested manually
- [ ] covered by existing tests
- [ ] added new unit test(s)
- [ ] added new functional test(s)
---------
Co-authored-by: Alex Stanfield <[email protected]>
## Summary
- Bump Alpine base image tag default to 3.23.3 for server/admin-tools
images.
- Update defaults in docker build bake args and manual build workflows.
## What changed?
* updates goreleaser to v2
* add GHA for build admin-tools and server images within this repo.
`docker-builds` will only be used for building pre 1.30 images
* added GHA to promote docker builds from temporaliotest to temproalio
docker image repos
* trivy security scanning gates for image promotion (pulled rom
docker-builds repo). The gate can be overridden
## Why?
* we decided to move away from building images in `docker-builds`. The
complexity is not needed
* updates goreleaser to v2 because the v1 definitions might be no longer
supported at some point and this is a good time to do it
* I used go scripts for the more complex flows instead of js or bash so
we don't introduce another language contributors need to be familiar
with. IMO the js or bash I did use it simple enough to understand.
## How did you test it?
It passes in CI.
## Potential risks
* these build pipelines are only compatible with the new docker images.
* merging this PR may break our nightly tests. Will double check before
merging
* flows that are not triggered by opening a PR are untested and
therefore not completely validated
