Container image hasn't been published since 1.0.5, but the README and k8s base still deploy `:latest`

[matt-edmondson]

What's wrong

The design spec says the service "Ships as a container image and a dotnet tool from one binary":
docs/superpowers/specs/2026-08-19-gitbranchstatecache-design.md L205-207 in ktsu-dev/GitLfsCache``

Deployment

Ships as a container image and a dotnet tool from one binary, as ktsu.GitLfsCache does.

What exists today:

• The dotnet tool part is done and publishes on every release (NuGet is at 1.0.36, matching VERSION.md).
• deploy/container/Dockerfile exists.
• README.md:44 (docker pull ghcr.io/ktsu-dev/gitbranchstatecache:latest) and deploy/k8s/statefulset.yaml:28 both point at the image.

What's missing:

• The scaffold's dotnet.yml had a container: job that pushed to ghcr.
• That job was dropped in 560cd9c ("ci: adopt the unified dotnet workflow"), and nothing replaced it.
• The current .github/workflows/ci.yml calls the shared ci-shared.yml, which has no container step.
• ghcr has tags 1.0.0 to 1.0.5, and latest is the same digest as 1.0.5.

Failure scenario

Anyone who follows the README or applies deploy/k8s runs 1.0.5. That build is missing every fix released since, for example #23, #24, #37, #42, #43, #45, #46 and #47. Nothing signals the problem, because :latest still pulls successfully.

Suggested fix

Add a job that runs after a release. It should build deploy/container/Dockerfile for linux/amd64 and linux/arm64 and push both <version> and latest to ghcr.io/ktsu-dev/gitbranchstatecache.

The job can live in this repo's ci.yml or as an opt-in input on the shared ci-shared.yml. A shared input would also fix ktsu-dev/GitLfsCache#80, which is the same regression in the sister repo.

This repo needs the Dockerfile route rather than PublishContainer, because the image needs git installed.

Acceptance criteria

• A release publishes ghcr.io/ktsu-dev/gitbranchstatecache:<version> and moves latest to it, for both architectures.
• docker pull ghcr.io/ktsu-dev/gitbranchstatecache:1.0.N works for the release that adds the job.

[matt-edmondson]

Triage

• Category: Bug (release pipeline regression).
• Priority: High. The documented deployment paths (the README docker pull …:latest and deploy/k8s) silently run 1.0.5, which is missing every fix since, while NuGet is at 1.0.36. Nothing signals the problem to users.
• Area / suggested assignment: CI and release. The preferred home is an opt-in container input on the shared ci-shared.yml in ktsu-dev/.github, because it fixes this repo and No container image has been published since 2026-08-26: the CI migration dropped the ghcr publish job, but README and deploy/k8s still pull ghcr.io/ktsu-dev/gitlfscache:latest GitLfsCache#80 at once. The image needs the Dockerfile route, because git must be installed in it.
• Duplicates / related: Same regression as No container image has been published since 2026-08-26: the CI migration dropped the ghcr publish job, but README and deploy/k8s still pull ghcr.io/ktsu-dev/gitlfscache:latest GitLfsCache#80 in the sister repo. Fix them together.
• In progress: No open PR covers it. The open PRs here (Bump Testably.Abstractions.FileSystem.Interface from 10.3.0 to 10.4.0 #54, Bump Testably.Abstractions.Testing from 7.0.2 to 7.1.1 #67) are dependency bumps.

---

Generated by Claude Code