chore(release): 0.8.0, and give both images a tag that does not move

main has been carrying two unreleased batches: the default-route work from issue
#96 (including the fix for service units that were broken under every npm
deployment) and the six code defects from issue #99. The published versions
matched the repo exactly, so release.yml has been running green and skipping every
publish. This bumps all four so a merge actually ships.

  root      0.7.0 -> 0.8.0    cuts the v0.8.0 product release (repo-release.yml)
  worker    0.1.1 -> 0.1.2    the sessions gate, the cron refusal, doctor's warning
  receiver  0.1.0 -> 0.1.1    conditional GitHub arm, Azure Graph pagination
  admin     0.4.0 -> 0.5.0    the wizard becomes the default route

The two literals in setup-wizard.ts move with them, which is what the anti-drift
tests exist to force: the wizard installs a PINNED runtime and a PINNED receiver,
so a bump that missed them would print an install command for a version that no
longer matches the console. Two tests spell the receiver pin out on purpose rather
than interpolating it, so both were updated by hand; that is the pin being visible
working as designed, not a maintenance tax to remove.

Docker gets the part it was missing. Both images were tagged `latest` and the git
sha and nothing else, so there was no such thing as releasing a version of them:
an operator could either track a moving tag or copy a sha. Both workflows now also
tag the PRODUCT version from the root package.json, and both rebuild when that
version changes, so v0.8.0 publishes ghcr.io/edgehero/pi-job:0.8.0 and
ghcr.io/edgehero/pi-dispatch-receiver:0.8.0 alongside latest. docs/job-image.md
records the trade honestly: a pinned base is right for a derived image whose layer
assumes something about it, and the cost is that a pin does not pick up a security
rebuild.

Signed-off-by: Rob Boerman <robboerman@live.nl>

Author: edgehero

.github/workflows/image.yml

@@ -8,6 +8,9 @@
 # No secret required: GHCR auth uses the built-in GITHUB_TOKEN (packages: write). One-time after the first
 # successful run: make the ghcr.io/edgehero/pi-job package Public in the org's package settings, otherwise
 # `docker pull` needs auth.
+#
+# Tags: `latest`, the git `sha`, and the PRODUCT version from the root package.json (so a release cuts a
+# tag that never moves, and a deployment can pin `ghcr.io/edgehero/pi-job:<version>` instead of tracking latest).
 
 name: image
 
@@ -16,6 +19,7 @@ on:
     branches: [main]
     paths:
       - "image/**"
+      - "package.json" # the ROOT one: a product version bump republishes under its own tag
       - ".github/workflows/image.yml"
   # Manual re-run (available once this file is on the default branch).
   workflow_dispatch: {}
@@ -46,13 +50,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Resolve the product version (the tag operators can pin)
+        id: v
+        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
       - name: Tags + labels
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.IMAGE }}
           tags: |
             type=raw,value=latest
+            type=raw,value=${{ steps.v.outputs.version }}
             type=sha
 
       - name: Build + push (amd64 + arm64)

.github/workflows/receiver-image.yml

@@ -10,6 +10,9 @@
 # No secret required: GHCR auth uses the built-in GITHUB_TOKEN (packages: write). One-time after the first
 # successful run: make the ghcr.io/edgehero/pi-dispatch-receiver package Public in the org's package
 # settings, otherwise `docker pull` needs auth.
+#
+# Tags: `latest`, the git `sha`, and the PRODUCT version from the root package.json (so a release cuts a
+# tag that never moves, and a deployment can pin `ghcr.io/edgehero/pi-dispatch-receiver:<version>` instead of tracking latest).
 
 name: receiver-image
 
@@ -21,6 +24,7 @@ on:
       - "worker/src/**"
       - "worker/package.json"
       - "package-lock.json"
+      - "package.json" # the ROOT one: a product version bump republishes under its own tag
       - ".github/workflows/receiver-image.yml"
   # Manual re-run (available once this file is on the default branch).
   workflow_dispatch: {}
@@ -51,13 +55,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Resolve the product version (the tag operators can pin)
+        id: v
+        run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
       - name: Tags + labels
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.IMAGE }}
           tags: |
             type=raw,value=latest
+            type=raw,value=${{ steps.v.outputs.version }}
             type=sha
 
       - name: Build + push (amd64 + arm64)

admin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-admin",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Operator console (a pi extension) + skill for pi-dispatch: run the pi coding agent as a self-hosted service. A /dispatch TUI for the queue, spend caps, run history, editable GitHub, GitLab, Forgejo and Azure DevOps triggers (cron/label/comment/PR/MR/work item), and scheduled pause windows — plus AI-operable, human-confirmed controls. Runs against a live pi-dispatch deployment.",
   "keywords": [
     "pi-package",

admin/src/setup-wizard.ts

@@ -52,7 +52,7 @@ type Notify = ((message: string, type?: string) => void) | undefined;
  * version, so a release bump stays atomic: bump the worker and the test fails here until this literal
  * follows in the same change.
  */
-export const RUNTIME_VERSION = "0.1.1";
+export const RUNTIME_VERSION = "0.1.2";
 
 /**
  * The `@edgehero/pi-dispatch-receiver` version the trigger-edge step installs -- pinned for exactly the
@@ -62,7 +62,7 @@ export const RUNTIME_VERSION = "0.1.1";
  * independently (the receiver's dependency range on the runtime is `^`), and pretending otherwise would
  * install a version that does not exist the first time they diverge.
  */
-export const RECEIVER_VERSION = "0.1.0";
+export const RECEIVER_VERSION = "0.1.1";
 
 /** The two npm package names, spelled once. Literals of this module -- see npmInstallArgsFor's argument. */
 const RUNTIME_PKG = "@edgehero/pi-dispatch";

admin/test/setup-wizard.test.mjs

@@ -803,7 +803,7 @@ test("wizard: the edge's service answer installs the PINNED receiver, then the -
   assert.equal(attached.length, 2, "the npm install and the unit install — nothing else");
   assert.equal(attached[0].argv0, "npm", "posix npm, per npmSpawnOptions");
   assert.deepEqual(attached[0].args, mod.npmInstallArgsFor(RECEIVER_PKG, mod.RECEIVER_VERSION));
-  assert.ok(attached[0].args.includes(`${RECEIVER_PKG}@0.1.0`), "the pinned name@version token, spelled out");
+  assert.ok(attached[0].args.includes(`${RECEIVER_PKG}@0.1.1`), "the pinned name@version token, spelled out");
   assert.equal(attached[0].cwd, dir, "installed into the deployment dir, by cwd");
   assert.deepEqual(
     JSON.parse(readFileSync(join(dir, "package.json"), "utf8")),
@@ -817,7 +817,7 @@ test("wizard: the edge's service answer installs the PINNED receiver, then the -
   assert.equal(attached[1].cwd, dir);
 
   const c = seen.confirm.find((x) => /receiver/i.test(x.title));
-  assert.match(c.message, new RegExp(`${RECEIVER_PKG.replace("/", "\\/")}@0\\.1\\.0`), "the confirm shows the exact pin");
+  assert.match(c.message, new RegExp(`${RECEIVER_PKG.replace("/", "\\/")}@0\\.1\\.1`), "the confirm shows the exact pin");
   assert.match(c.message, /service install --receiver/, "and the unit command it will run after");
   assert.ok(c.message.includes(dir), "and names the cwd");
   assert.ok(reachedFirstTrigger(seen), "the wizard continued to step 11");

docs/job-image.md

@@ -36,6 +36,12 @@ a second thing to forget to bump. Re-declare only a label whose truth your layer
 single re-declared `dev.pi-dispatch.forges` with `azure` appended (see
 [azure-devops.md](azure-devops.md), which also names the `--build-arg BASE=…` you need).
 
+**Pin the base if you would rather not track `latest`.** Every published build also carries the **product
+version** as a tag (`ghcr.io/edgehero/pi-job:0.8.0`) and the git `sha`, and neither ever moves, while
+`latest` follows `main`. The receiver image is tagged the same way. A pinned base is the honest choice for a
+derived image whose layer assumes something about the base; the cost is that a pin does not pick up a
+security rebuild, so bump it deliberately.
+
 **Copy `image/Dockerfile` and add to it.** You inherit every property in the checklist below for free, and
 the only thing you own is your own `RUN apt-get install …` layer. Prefer this over the layer above only when
 you need to change something *inside* the base build (a different base distro, a different pi pin).

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-dispatch",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": true,
   "description": "A containerized job harness for the pi coding agent",
   "license": "MIT",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-receiver",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "Webhook receiver for pi-dispatch: the always-on edge that verifies GitHub, GitLab, Forgejo and Azure DevOps deliveries and enqueues (at most) one job per event for the worker.",
   "keywords": [

receiver/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "description": "Self-hosted job harness for the pi coding agent: a BullMQ worker that drains the queue, mints scoped forge tokens, and runs one container per job — plus the pi-dispatch CLI (init, up, doctor, service).",
   "keywords": [