[TakGN]

Release tags never started docker.yml, so every release image had to be built by hand. This makes the Releaser start that build itself.

Confirmed cause

The Releaser creates the tag with GITHUB_TOKEN, and a push made with GITHUB_TOKEN does not start other workflows.

• Token used: the reusable workflow passes secrets.UCI_GITHUB_TOKEN || github.token to the release action. This repo has no UCI_GITHUB_TOKEN: actions/secrets and actions/organization-secrets both return total_count: 0.
• Who made the tags: the releases for v0.16.0-ipni.1, v0.16.0-ipni.2, v1.0.0 and v1.1.0 were all authored by github-actions[bot].
• Effect: those four tags have one run each, a manual workflow_dispatch of docker.yml (for v1.1.0, 41626211367). None has a push run. The v1.1.0 Releaser run (41624924279) succeeded, so nothing failed visibly.

Tag Push Checker has the same cause and has never run (0 runs).

Fix

A new publish-image job in releaser.yml runs after the release and calls gh workflow run docker.yml --ref <tag>. workflow_dispatch is the documented exception to the GITHUB_TOKEN rule, and this is the same action people were taking by hand, so the build, ref and image tags are unchanged.

• The job only runs when the Releaser actually created a release, using the same if as filecoin-ffi. Other version.json pushes and re-runs on an existing tag do not move latest.
• actions: write is scoped to this job.

Why not set UCI_GITHUB_TOKEN

It needs a long-lived credential, and it would have a side effect: Tag Push Checker would start running on release tags and, unless the pusher is web3-bot, open a "manual release created" issue for every release. Leaving it unset keeps that nag for tags pushed by hand, which is what it is for, so tagpush.yml is unchanged.

If the secret is set later, tag pushes would also trigger docker.yml, so each release would build twice.

How it was checked

No tags were created or moved, and no images were published.

On a throwaway branch (since deleted), with docker.yml replaced by a stub that only logged in to GHCR:

Check	Result
GITHUB_TOKEN with only actions: write dispatches docker.yml	Started 41638818559 as workflow_dispatch
if with stubbed output shaped like a release (41624924279)	Job ran
if with stubbed output shaped like no release (41624338037)	Job skipped
GHCR login as github-actions[bot], the actor on dispatched runs	41638938845 logged in

actionlint passes on releaser.yml. The stub runs remain in the docker.yml run history under the deleted branch.

Not tested: an end-to-end run. These paths only run for a real release:

• dispatching on a tag ref from this job (manual tag dispatches do work)
• pushing to GHCR as github-actions[bot] (only the login was tested)
• reading the output of the real reusable workflow (stubbed here)

After the next release, confirm that a docker.yml run started by github-actions[bot] appears for the tag and that the image exists before pinning its digest. If it doesn't, the manual dispatch still works.

🤖 Generated with Claude Code