Map the image channels to how this repo ships, and disarm auto-publish

The channel work assumed the branch model it was written against: upstream,
main is a release branch and dev-be is the trunk. Neither holds here. main IS
our trunk - 212 commits past v0.11.3 - and a release is a tag (ADR-007). dev-be
does not exist at all, so the edge half would never have fired and the launchers
would have cloned a missing branch.

Taken literally it would have published our unreleased trunk to every site as
:stable, which is the opposite of what the word promises to someone who has no
way to check.

Remapped throughout:

  tag v*  -> :stable   the thing that was actually released
  main    -> :edge     the trunk, DEV badge lit

publish-images.yml keys the channel on github.ref_type = tag rather than on a
branch name, so the mapping cannot silently drift back. Start-ShopDBDev.ps1,
dev-bootstrap.ps1 and build-channel-installer.ps1 resolve stable to the newest
v* tag via git ls-remote --sort=-v:refname, warning and falling back to main if
a repo has no tags yet. DEV-BUILD-TEST.md follows.

The push: trigger is commented out. Automatic publishing waits on someone
confirming the GHCR package exists under this owner and deciding who may pull
it; workflow_dispatch works meanwhile. Turning it on is one uncomment.

All three scripts parse clean under pwsh, and the tag-selection expression was
run against this repo rather than eyeballed. Per the standing rule, the runtime
paths still want a pass in the win11 VM before anyone leans on them.

Scope: product

.github/workflows/publish-images.yml

@@ -8,22 +8,31 @@
 # A single image pull is one resumable HTTPS stream, far more robust through
 # the proxy than hundreds of npm requests.
 #
-# Channels map to branches:
+# Channels are mapped to how THIS repo actually ships, which is not how the
-#   main   -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)
+# branch this came from ships. Upstream, main is a release branch and dev-be is
-#   dev-be -> ghcr.io/<owner>/shopdb-flask:edge    (SHOPDB_ENV_LABEL=DEV badge)
+# the trunk. Here main IS the trunk - it runs hundreds of commits past the last
+# release - and releases are tags (ADR-007). Publishing main as :stable would
+# put unreleased work behind a word that promises the opposite, to sites that
+# have no way to know:
 #
-# Each push to those branches rebuilds and republishes its channel tag, so
+#   tag v*  -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)  the release
-# `edge` stays genuinely bleeding edge. The image is also tagged with the short
+#   main    -> ghcr.io/<owner>/shopdb-flask:edge    (DEV badge)  the trunk
-# commit SHA for traceability and rollback.
+#
+# The image also carries a short-SHA tag for traceability and rollback.
+#
+# Automatic publishing is OFF until someone confirms the GHCR package exists
+# under this owner and decides who may pull it. Re-enable by uncommenting the
+# push: block below; workflow_dispatch works meanwhile.
 
 name: publish-images
 
 on:
-  push:
+  # push:
-    branches:
+  #   tags:
-      - main
+  #     - 'v*'
-      - dev-be
+  #   branches:
-  # Allow a manual rebuild/publish of the current branch's channel image.
+  #     - main
+  # Manual rebuild/publish of the current ref's channel image.
   workflow_dispatch:
 
 # One in-flight publish per branch; a newer push supersedes an older one.
@@ -48,7 +57,10 @@ jobs:
         run: |
           owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
           image="ghcr.io/${owner}/shopdb-flask"
-          if [ "${{ github.ref_name }}" = "main" ]; then
+          # A tag is a release, anything else is the trunk. Deliberately not
+          # keyed on the branch name: a release here is a tag, so keying on
+          # "main" would label the trunk stable.
+          if [ "${{ github.ref_type }}" = "tag" ]; then
             channel="stable"
           else
             channel="edge"

docs/DEV-BUILD-TEST.md

@@ -22,14 +22,14 @@ so it works on a box that has only Docker installed.
 You will be sent `Start-ShopDBDev.ps1` directly. Save it anywhere (for example
 your Downloads folder) and open PowerShell in that folder.
 
-## Bleeding edge (dev-be)
+## Bleeding edge (main, the trunk)
 
 	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel edge
 
 Comes up at https://localhost:5011. Red DEV badge in the sidebar. Pulls the
 `edge` image.
 
-## Stable (main)
+## Stable (newest release tag)
 
 	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel stable
 

scripts/Start-ShopDBDev.ps1

@@ -19,7 +19,7 @@
 	GCM handles those.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'.
 
 .PARAMETER TargetDir
 	Where to clone. Defaults to %USERPROFILE%\shopdb-dev, a separate working copy
@@ -114,7 +114,18 @@ function Clear-InterruptedRun {
 # stored GitHub credential for github.com, so clone/fetch authenticate against
 # the private repo without anything sensitive touching this script or disk.
 $repoUrl = 'https://github.com/ge-aero/shopdb-flask.git'
-$branch = if ($Channel -eq 'edge') { 'dev-be' } else { 'main' }
+# Channels follow how this repo ships: a release is a TAG, the trunk is main.
+# Upstream this read 'dev-be' for edge, which is that repo's trunk branch and
+# does not exist here - the launcher would have cloned a missing branch.
+$branch = 'main'
+if ($Channel -ne 'edge') {
+	# Newest release tag, so 'stable' means a thing that was released rather
+	# than whatever the trunk happens to be today.
+	$tag = (git ls-remote --tags --refs --sort='-v:refname' $repoUrl 'v*' |
+		Select-Object -First 1) -replace '.*refs/tags/', ''
+	if ($tag) { $branch = $tag }
+	else { Write-Warning "No v* tag found; falling back to main for 'stable'." }
+}
 $target = if ($TargetDir) { $TargetDir } else { Join-Path $env:USERPROFILE 'shopdb-dev' }
 
 Write-Host "ShopDB dev launcher" -ForegroundColor White

scripts/build-channel-installer.ps1

@@ -6,7 +6,7 @@
 	Produces ONE self-contained installer package for the requested channel:
 
 	  stable -> built from 'main',   no DEV badge (SHOPDB_ENV_LABEL empty).
-	  edge   -> built from 'dev-be', red DEV badge (SHOPDB_ENV_LABEL=DEV).
+	  edge   -> built from 'main' (the trunk), red DEV badge (SHOPDB_ENV_LABEL=DEV).
 
 	This is the distributable counterpart to scripts/dev-bootstrap.ps1 (which
 	stands a dev box up FROM the repo). Here the operator has no repo: the script
@@ -28,14 +28,14 @@
 	by branch, image tag, and label - all data, not code.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Required.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Required.
 
 .PARAMETER Version
 	Image tag / bundle version. Defaults to a channel-prefixed date stamp so two
 	channels built the same day never collide (e.g. 'stable-2024.06.01').
 
 .PARAMETER Ref
-	Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for
+	Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for
 	edge. Lets a release engineer cut an installer from a tag or fix branch.
 
 .PARAMETER MysqlImage
@@ -85,7 +85,7 @@ $ErrorActionPreference = 'Stop'
 # channel means.
 $channels = @{
 	stable = @{ Ref = 'main';   EnvLabel = '' }
-	edge   = @{ Ref = 'dev-be'; EnvLabel = 'DEV' }
+	edge   = @{ Ref = 'main'; EnvLabel = 'DEV' }
 }
 
 function Assert-LastExit([string]$What) {

scripts/dev-bootstrap.ps1

@@ -12,7 +12,7 @@
 		 passed, because the app itself runs entirely in the container.
 	  2. Picks a channel:
 		   stable  -> pulls the 'stable' image (built from main), no DEV badge.
-		   edge    -> pulls the 'edge' image (built from dev-be), red DEV badge.
+		   edge    -> pulls the 'edge' image (built from main), red DEV badge.
 		 The two channels use different compose project names, host ports, and
 		 named volumes, so they run side by side without colliding.
 	  3. Generates a .env for the channel (dev-grade secrets, NOT for production)
@@ -25,10 +25,10 @@
 	installer - see deploy/windows/installer/shopdb-install.ps1 for that.
 
 .PARAMETER Channel
-	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+	'stable' (the newest release tag) or 'edge' (main, the trunk). Defaults to 'stable'.
 
 .PARAMETER Ref
-	Override the git ref to build. Defaults to 'main' for stable, 'dev-be' for
+	Override the git ref to build. Defaults to the newest v* tag for stable, 'main' for
 	edge. Retained for compatibility; the pull flow selects the image by channel
 	tag, so this now only affects which branch the working tree is prepared on.
 
@@ -74,7 +74,7 @@ $channels = @{
 		ImageTag  = 'stable'
 	}
 	edge = @{
-		Ref       = 'dev-be'
+		Ref       = 'main'
 		Project   = 'shopdb-edge'
 		ApiPort   = 5011
 		MysqlPort = 3316