[samunohito]

リリースworkflowはこれまでビルド直後にpushしていたため、公開イメージの起動・推論が確認されていませんでした。amd64・arm64それぞれでビルドしたイメージをロードし、#41と同じ検証に成功したそのimage IDを再ビルドせずpushするようにします。

• Docker検証を共通actionへ移し、PRのCIとリリースの両方から実行
• native runnerで、組み込みHEALTHCHECK、/healthの200、認証なし401、固定画像のNeutral/Sexy推論を確認
• 起動・HTTP・Docker操作の時間制限、失敗時の診断とコンテナ削除を維持
• 検証成功後にGHCRへログインし、検証済みの不変image IDを直接tag/push
• 公開先のmanifest digestを既存mergeジョブへ渡し、両architecture成功後に従来のsemverタグを公開
• releaseイベントのcommit SHAをcheckoutし、同名branch/tagの曖昧さを排除

受け渡し用のbuild-<run-id>-<attempt>-linux-<arch>補助タグがGHCRに残ります。モデル、fixture、公開API、本番の判定仕様は変更しません。

検証：

• PR CI全5ジョブ成功。native amd64・arm64で共通actionの検証・コンテナ削除まで確認
• Node.js22で全165テスト、型チェック、lint、既存server E2E、actionlint
• 実際のaction/stepのshellを使い、native amd64の実イメージをローカルregistryへpush。registryのconfig digestと検証済みimage IDの一致、manifest作成を確認
• 検証途中でローカルtagを別イメージへ差し替えても、元のIDで検証・pushされることを確認
• APIキー不一致時の失敗・診断・削除と、誤った／曖昧なmanifest digestの拒否を確認
• 独立エージェントの敵対的レビュー→checkoutの問題を修正→再レビューで実質的な指摘なし。CodeRabbitも指摘なし

実際のGHCRへの公開やrelease作成は行っていません。ローカルregistryで公開経路を検証し、PRのCIで両native architectureの共通actionを確認しました。

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0f5ae0fe-8787-4a6c-a4ba-7a63a11361f8

Commits

Reviewing files that changed from the base of the PR and between 0b7e7c7 and 67a65df.

Files selected for processing: 2

• docs/superpowers/plans/2026-11-06-docker-ci.md
• docs/superpowers/plans/2026-11-06-server-e2e.md

No actionable comments were generated in the recent review.

Walkthrough

The CI workflow now uses a shared action to test locally built Docker images. The release workflow builds native amd64 and arm64 images, tests each image before pushing its verified image ID, and exports registry digests. The README and plan describe the release flow.

Changes: Docker image verification and release

Layer / File(s)	Summary
Shared image verification .github/actions/test-docker-image/action.yml, .github/workflows/ci.yml	The composite action resolves and validates an image ID, starts a test container, runs Docker E2E tests, collects failure diagnostics, and removes the container. The CI job passes its built image to the action.
Build and publish verified images .github/workflows/docker.yml, README.md, docs/superpowers/plans/2026-11-06-verified-docker-release.md	The release workflow builds native amd64 and arm64 images, verifies each image, pushes its verified image ID, and exports the registry digest. The README and plan describe the release flow.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant BuildJob as Architecture build job
  participant TestAction as test-docker-image action
  participant GHCR
  participant DigestStep as Digest export step
  BuildJob->>TestAction: Verify locally loaded image
  TestAction-->>BuildJob: Return verified image ID
  BuildJob->>GHCR: Push verified image ID
  GHCR-->>BuildJob: Return registry digest
  BuildJob->>DigestStep: Export registry digest

Loading

Possibly related issues

• Issue 39 — The PR adds shared Docker E2E verification for image health, authentication, and image predictions, matching the issue’s requested checks.

Possibly related PRs

• misskey-dev/sensitive-detector#41: Adds the Docker E2E checks and CI job that this PR moves into a shared action and uses for release-image verification.
• misskey-dev/sensitive-detector#40: Adds the image checker and fixtures used by the Docker E2E checks in this PR.

Merge Risk: Minimal · previous review 0b7e7

No actionable merge-blocking issue is established for the verified-image release flow. Mergeability remains subject to normal CI checks succeeding.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly describes verification of Docker images before release.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description matches the changes. It explains the shared Docker verification action and the release workflow that pushes the verified image ID.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

_{I’m a rabbit by the build, with a carrot held up high,
I test each native image before it takes to sky.
The verified ID goes on, unchanged along the way,
And digests mark the trail where both platforms stay.
I thump beside the manifest when the checks are done today.}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 743beb05-0e29-40af-a7d5-e8e74abdae58

Commits

Reviewing files that changed from the base of the PR and between fc37bbb and 0b7e7c7.

Files selected for processing: 5

• .github/actions/test-docker-image/action.yml
• .github/workflows/ci.yml
• .github/workflows/docker.yml
• README.md
• docs/superpowers/plans/2026-11-06-verified-docker-release.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.