Merge remote-tracking branch 'origin/next' into reverb-realtime-migration

.github/ISSUE_TEMPLATE/01_BUG_REPORT.yml

@@ -8,6 +8,8 @@ body:
       value: |
         > [!IMPORTANT]
         > **Please ensure you are using the latest version of Coolify before submitting an issue, as the bug may have already been fixed in a recent update.** (Of course, if you're experiencing an issue on the latest version that wasn't present in a previous version, please let us know.)
+        >
+        > If you plan to submit a fix, branch from `main` and target `main` with your pull request.
 
   - type: textarea
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -7,12 +7,12 @@ contact_links:
 
   - name: 💡 Feature Request
     url: https://github.com/coollabsio/coolify/discussions/categories/feature-requests
-    about: Suggest a new feature for Coolify.
+    about: Suggest a new feature for Coolify. Feature code should branch from `next` and target `next`.
 
   - name: ⚙️ Service Request
     url: https://github.com/coollabsio/coolify/discussions/categories/service-requests
-    about: Request a new service integration for Coolify.
+    about: Request a new service integration for Coolify. Service code should branch from `next` and target `next`.
 
   - name: 🔧 Improvements
     url: https://github.com/coollabsio/coolify/discussions/categories/improvements
-    about: Suggest improvements to existing features for Coolify.
+    about: Suggest improvements to existing features. Small fixes should target `main`; larger changes should target `next`.

.github/pull_request_template.md

@@ -46,6 +46,6 @@
 
 > [!IMPORTANT]
 >
-> - [ ] I have read and understood the [contributor guidelines](https://github.com/coollabsio/coolify/blob/v4.x/CONTRIBUTING.md). If I have failed to follow any guideline, I understand that this PR may be closed without review.
+> - [ ] I have read and understood the [contributor guidelines](https://github.com/coollabsio/coolify/blob/HEAD/CONTRIBUTING.md). If I have failed to follow any guideline, I understand that this PR may be closed without review.
 > - [ ] I have searched [existing issues](https://github.com/coollabsio/coolify/issues) and [pull requests](https://github.com/coollabsio/coolify/pulls) (including closed ones) to ensure this isn't a duplicate.
 > - [ ] I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.

.github/workflows/chore-lock-closed-issues-discussions-and-prs.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lock threads after 30 days of inactivity
-        uses: dessant/lock-threads@v5
+        uses: dessant/lock-threads@89ae32b08ed1a541efecbab17912962a5e38981c # v6.0.2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           issue-inactive-days: '30'

.github/workflows/chore-manage-pr-branch.yaml

@@ -0,0 +1,182 @@
+name: Manage PR Branch
+
+# Runs *after* the "PR Quality" workflow finishes. This is required because
+# PR Quality may close a PR that fails its checks, so we must wait for it to
+# complete before deciding whether to retarget the PR's base branch.
+on:
+  workflow_run:
+    workflows: ["PR Quality"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: manage-pr-branch-${{ github.event.workflow_run.head_sha }}
+  cancel-in-progress: true
+
+jobs:
+  manage-branch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Retarget PR base branch based on category
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+
+            // Branch routing based on the "Category" section of the PR body.
+            // Bug fixes and one-click service changes ship in patch releases -> main.
+            // Everything else (features, improvements) -> next.
+            const MAIN_BRANCH = 'main';
+            const NEXT_BRANCH = 'next';
+
+            // Maintainers/collaborators are trusted to pick their own base branch.
+            const EXEMPT_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+
+            // Resolve the open PR from the triggering run.
+            //
+            // PR Quality runs on `pull_request_target`, so `run.head_sha` is the
+            // *base* branch tip, not the PR head — a commit-based lookup finds
+            // nothing. Instead match on the source branch (`head_branch`) and its
+            // owner (`head_repository.owner.login`), which uniquely identify the PR
+            // via the `owner:branch` head filter. This also works for forked PRs,
+            // where `workflow_run.pull_requests` is empty.
+            const headOwner = run.head_repository?.owner?.login;
+            const headBranch = run.head_branch;
+
+            let prRef;
+            if (headOwner && headBranch) {
+              const { data: openPrs } = await github.rest.pulls.list({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                state: 'open',
+                head: `${headOwner}:${headBranch}`,
+                per_page: 100,
+              });
+              prRef = openPrs[0];
+            }
+
+            // Fallback: same-repo PRs may also be resolvable by commit association.
+            if (!prRef) {
+              const { data: associated } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                commit_sha: run.head_sha,
+              });
+              prRef = associated.find(pr => pr.state === 'open');
+            }
+
+            if (!prRef) {
+              core.info('No open PR associated with this run (possibly closed by PR Quality). Skipping.');
+              return;
+            }
+
+            // Fetch the full PR to get an up-to-date body, base ref, and state.
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prRef.number,
+            });
+
+            if (pr.state !== 'open') {
+              core.info(`PR #${pr.number} is not open. Skipping.`);
+              return;
+            }
+
+            // Skip PRs opened by owners/members/collaborators — they choose their own base.
+            if (EXEMPT_ASSOCIATIONS.has(pr.author_association)) {
+              core.info(`PR #${pr.number} author association is ${pr.author_association}. Skipping.`);
+              return;
+            }
+
+            // Skip if a maintainer has already changed the base branch manually.
+            const timeline = await github.paginate(github.rest.issues.listEventsForTimeline, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              per_page: 100,
+            });
+
+            const baseChanges = timeline.filter(e => e.event === 'base_ref_changed');
+            for (const change of baseChanges) {
+              const actor = change.actor?.login;
+              if (!actor) {
+                continue;
+              }
+              try {
+                const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  username: actor,
+                });
+                // admin/maintain/write => trusted maintainer.
+                if (['admin', 'maintain', 'write'].includes(perm.permission)) {
+                  core.info(`Base branch was changed manually by ${actor} (${perm.permission}). Skipping.`);
+                  return;
+                }
+              } catch (error) {
+                core.info(`Could not resolve permission for ${actor}: ${error.message}`);
+              }
+            }
+
+            // Parse the checked category checkboxes from the PR body.
+            const body = pr.body ?? '';
+            const checked = [];
+            const checkboxRegex = /^\s*-\s*\[([ xX])\]\s*(.+?)\s*$/gm;
+            let match;
+            while ((match = checkboxRegex.exec(body)) !== null) {
+              if (match[1].toLowerCase() === 'x') {
+                checked.push(match[2].toLowerCase());
+              }
+            }
+
+            const includesAny = (labels) => labels.some(label => checked.some(c => c.includes(label)));
+
+            const mainCategories = ['bug fix', 'adding new one click service', 'fixing or updating existing one click service'];
+            const nextCategories = ['improvement', 'new feature'];
+
+            const wantsMain = includesAny(mainCategories);
+            const wantsNext = includesAny(nextCategories);
+
+            if (!wantsMain && !wantsNext) {
+              core.info('No category selected in the PR body. Skipping.');
+              return;
+            }
+
+            // If categories from both groups are checked, prefer next: features and
+            // improvements can only be released from the development branch.
+            const targetBranch = wantsNext ? NEXT_BRANCH : MAIN_BRANCH;
+
+            if (pr.base.ref === targetBranch) {
+              core.info(`PR #${pr.number} already targets ${targetBranch}. Nothing to do.`);
+              return;
+            }
+
+            const previousBranch = pr.base.ref;
+
+            await github.rest.pulls.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+              base: targetBranch,
+            });
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: pr.number,
+              body: [
+                `Based on the selected category, this PR's base branch was automatically changed from \`${previousBranch}\` to \`${targetBranch}\`.`,
+                '',
+                targetBranch === MAIN_BRANCH
+                  ? 'Bug fixes and one-click service changes target `main`.'
+                  : 'New features and improvements target `next`.',
+                '',
+                'If you believe this is incorrect, please let a maintainer know.',
+              ].join('\n'),
+            });
+
+            core.info(`Retargeted PR #${pr.number}: ${previousBranch} -> ${targetBranch}.`);

.github/workflows/coolify-helper.yml

@@ -2,7 +2,7 @@ name: Coolify Helper Image
 
 on:
   push:
-    branches: [ "v4.x" ]
+    branches: [ "main" ]
     paths:
       - .github/workflows/coolify-helper.yml
       - docker/coolify-helper/Dockerfile
@@ -16,8 +16,53 @@ env:
   DOCKER_REGISTRY: docker.io
   IMAGE_NAME: "coollabsio/coolify-helper"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  check-version:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Ensure version is not published
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getHelperVersion.php)
+          VERSION="${BASE_VERSION}"
+          for registry in "${DOCKER_REGISTRY}" "${GITHUB_REGISTRY}"; do
+            IMAGE="${registry}/${IMAGE_NAME}:${VERSION}"
+            if output=$(docker buildx imagetools inspect "$IMAGE" 2>&1); then
+              echo "::error::Version $VERSION already exists in $registry"
+              exit 1
+            fi
+            if ! grep -Eqi 'manifest unknown|not found|no such manifest' <<< "$output"; then
+              echo "::error::Could not verify $IMAGE: $output"
+              exit 1
+            fi
+          done
+          echo "Version $VERSION is available in both registries"
+
   build-push:
+    needs: check-version
     strategy:
       matrix:
         include:
@@ -113,4 +158,3 @@ jobs:
         if: always()
         with:
           webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL  }}
-

.github/workflows/coolify-release.yml

@@ -0,0 +1,259 @@
+name: Release Coolify Stable
+run-name: ${{ inputs.tag }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing draft release tag (for example, v4.3.1)
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: coolify-fix-release
+  cancel-in-progress: false
+
+env:
+  GITHUB_REGISTRY: ghcr.io
+  DOCKER_REGISTRY: docker.io
+  IMAGE_NAME: coollabsio/coolify
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    outputs:
+      release_id: ${{ steps.draft.outputs.release_id }}
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Reject releases outside the production branch
+        if: ${{ github.ref_name != 'main' }}
+        run: |
+          echo "Stable releases must run from main, not ${{ github.ref_name }}."
+          exit 1
+
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate version
+        id: version
+        env:
+          TAG_NAME: ${{ inputs.tag }}
+        run: |
+          if [[ ! "${TAG_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Unsupported fix release tag: ${TAG_NAME}"
+            exit 1
+          fi
+
+          VERSION="${TAG_NAME#v}"
+          CONFIG_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
+
+          if [[ "${CONFIG_VERSION}" != "${VERSION}" ]]; then
+            echo "Release tag ${VERSION} does not match config version ${CONFIG_VERSION}."
+            exit 1
+          fi
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate and pin draft release
+        id: draft
+        uses: actions/github-script@v8
+        env:
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              per_page: 100,
+            });
+            const release = releases.find((candidate) => candidate.tag_name === process.env.TAG_NAME);
+
+            if (!release) {
+              core.setFailed(`Create a draft release for ${process.env.TAG_NAME} before running this workflow.`);
+              return;
+            }
+            if (!release.draft) {
+              core.setFailed(`Release ${process.env.TAG_NAME} must still be a draft.`);
+              return;
+            }
+            if (release.prerelease) {
+              core.setFailed(`Fix release ${process.env.TAG_NAME} cannot be marked as a prerelease.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} must contain reviewed release notes.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} already exists.`);
+              return;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: release.id,
+              tag_name: process.env.TAG_NAME,
+              target_commitish: context.sha,
+            });
+            core.setOutput('release_id', release.id);
+
+  build:
+    needs: validate
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            platform: linux/aarch64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push release image (${{ matrix.arch }})
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          build-args: |
+            COOLIFY_VERSION=${{ needs.validate.outputs.version }}
+          tags: |
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:release-${{ needs.validate.outputs.version }}-${{ github.sha }}-${{ matrix.arch }}
+
+  publish:
+    needs: [validate, build]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to ${{ env.GITHUB_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.GITHUB_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Login to ${{ env.DOCKER_REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Publish version and latest on ${{ env.GITHUB_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.GITHUB_REGISTRY }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="release-${VERSION}-${GITHUB_SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:latest"
+
+      - name: Publish version and latest on ${{ env.DOCKER_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.DOCKER_REGISTRY }}
+          VERSION: ${{ needs.validate.outputs.version }}
+        run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SOURCE="release-${VERSION}-${GITHUB_SHA}"
+          docker buildx imagetools create \
+            "${IMAGE}:${SOURCE}-amd64" \
+            "${IMAGE}:${SOURCE}-aarch64" \
+            --tag "${IMAGE}:${VERSION}" \
+            --tag "${IMAGE}:latest"
+
+      - name: Publish reviewed draft release
+        uses: actions/github-script@v8
+        env:
+          RELEASE_ID: ${{ needs.validate.outputs.release_id }}
+          TAG_NAME: ${{ inputs.tag }}
+        with:
+          script: |
+            const releaseId = Number(process.env.RELEASE_ID);
+            const { data: release } = await github.rest.repos.getRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: releaseId,
+            });
+
+            if (release.tag_name !== process.env.TAG_NAME || !release.draft || release.prerelease) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} changed while the images were building.`);
+              return;
+            }
+            if (!release.body?.trim()) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} no longer contains release notes.`);
+              return;
+            }
+            if (release.target_commitish !== context.sha) {
+              core.setFailed(`Draft release ${process.env.TAG_NAME} no longer targets ${context.sha}.`);
+              return;
+            }
+
+            try {
+              await github.rest.git.getRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `tags/${process.env.TAG_NAME}`,
+              });
+              core.setFailed(`Git tag ${process.env.TAG_NAME} was created while the images were building.`);
+              return;
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: Number(process.env.RELEASE_ID),
+              tag_name: process.env.TAG_NAME,
+              target_commitish: context.sha,
+              draft: false,
+            });

.github/workflows/coolify-sha-build.yml

@@ -1,16 +1,8 @@
-name: Production Build (v4)
+name: Build Coolify (SHA)
 
 on:
   push:
-    branches: ["v4.x"]
-    paths-ignore:
-      - .github/workflows/coolify-helper.yml
-      - .github/workflows/coolify-helper-next.yml
-      - .github/workflows/pr-quality.yaml
-      - docker/coolify-helper/Dockerfile
-      - docker/testing-host/Dockerfile
-      - templates/**
-      - CHANGELOG.md
+    branches: ["main"]
 
 permissions:
   contents: read
@@ -23,6 +15,8 @@ env:
 
 jobs:
   build-push:
+    outputs:
+      short_sha: ${{ steps.version.outputs.short_sha }}
     strategy:
       matrix:
         include:
@@ -38,6 +32,13 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Resolve internal version
+        id: version
+        run: |
+          BASE_VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)
+          echo "version=${BASE_VERSION}-dev.${GITHUB_SHA::9}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
       - name: Login to ${{ env.GITHUB_REGISTRY }}
         uses: docker/login-action@v3
         with:
@@ -52,11 +53,6 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)"|xargs >> $GITHUB_OUTPUT
-
       - name: Build and Push Image (${{ matrix.arch }})
         uses: docker/build-push-action@v6
         with:
@@ -64,18 +60,16 @@ jobs:
           file: docker/production/Dockerfile
           platforms: ${{ matrix.platform }}
           push: true
+          build-args: |
+            COOLIFY_VERSION=${{ steps.version.outputs.version }}
           tags: |
-            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
-            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-${{ matrix.arch }}
+            ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}-${{ matrix.arch }}
+            ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.version.outputs.short_sha }}-${{ matrix.arch }}
 
   merge-manifest:
     runs-on: ubuntu-24.04
     needs: build-push
     steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-
       - uses: docker/setup-buildx-action@v3
 
       - name: Login to ${{ env.GITHUB_REGISTRY }}
@@ -92,28 +86,24 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Get Version
-        id: version
-        run: |
-          echo "VERSION=$(docker run --rm -v "$(pwd):/app" -w /app php:8.2-alpine3.16 php bootstrap/getVersion.php)"|xargs >> $GITHUB_OUTPUT
-
       - name: Create & publish manifest on ${{ env.GITHUB_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.GITHUB_REGISTRY }}
+          SHA: ${{ needs.build-push.outputs.short_sha }}
         run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
           docker buildx imagetools create \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.GITHUB_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+            "${IMAGE}:sha-${SHA}-amd64" \
+            "${IMAGE}:sha-${SHA}-aarch64" \
+            --tag "${IMAGE}:sha-${SHA}"
 
       - name: Create & publish manifest on ${{ env.DOCKER_REGISTRY }}
+        env:
+          REGISTRY: ${{ env.DOCKER_REGISTRY }}
+          SHA: ${{ needs.build-push.outputs.short_sha }}
         run: |
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
           docker buildx imagetools create \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-amd64 \
-          ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}-aarch64 \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-          --tag ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-
-      - uses: sarisia/actions-status-discord@v1
-        if: always()
-        with:
-          webhook: ${{ secrets.DISCORD_WEBHOOK_PROD_RELEASE_CHANNEL  }}
+            "${IMAGE}:sha-${SHA}-amd64" \
+            "${IMAGE}:sha-${SHA}-aarch64" \
+            --tag "${IMAGE}:sha-${SHA}"

.github/workflows/coolify-staging-build.yml

@@ -3,7 +3,7 @@ name: Staging Build
 on:
   push:
     branches-ignore:
-      - v4.x
+      - main
       - v3.x
       - '**v5.x**'
     paths-ignore:

.github/workflows/generate-changelog.yml

@@ -2,7 +2,7 @@ name: Generate Changelog
 
 on:
   push:
-    branches: [ v4.x ]
+    branches: [ main ]
     paths-ignore:
       - .github/workflows/coolify-helper.yml
       - .github/workflows/coolify-helper-next.yml
@@ -37,4 +37,4 @@ jobs:
           git config user.email 'github-actions[bot]@users.noreply.github.com'
           git add CHANGELOG.md
           git commit -m "docs: update changelog"
-          git push https://${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git v4.x
+          git push https://${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git HEAD:${GITHUB_REF_NAME}

.github/workflows/pr-quality.yaml

@@ -19,13 +19,10 @@ jobs:
           max-failures: 4
 
           # PR Branch Checks
-          allowed-target-branches: "next"
+          allowed-target-branches: ""
           blocked-target-branches: ""
           allowed-source-branches: ""
-          blocked-source-branches: |
-            main
-            master
-            v4.x
+          blocked-source-branches: ""
 
           # PR Quality Checks
           max-negative-reactions: 0

.github/workflows/sync-main-to-next.yml

@@ -0,0 +1,60 @@
+name: Sync main to next
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: sync-main-to-next
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    name: Merge main into next
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout next
+        uses: actions/checkout@v5
+        with:
+          ref: next
+          fetch-depth: 0
+
+      - name: Merge main into next
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git fetch origin main next
+
+          if git merge --no-edit origin/main; then
+            git push origin HEAD:next
+            exit 0
+          fi
+
+          conflicts=$(git diff --name-only --diff-filter=U)
+          git merge --abort
+
+          if [ -z "$conflicts" ]; then
+            echo 'The merge failed without conflicts, so no pull request was created.'
+            exit 1
+          fi
+
+          existing_pr=$(gh pr list --base next --head main --state open --json url --jq '.[0].url')
+          if [ -n "$existing_pr" ]; then
+            echo "A main to next pull request already exists: $existing_pr"
+          else
+            gh pr create \
+              --base next \
+              --head main \
+              --title 'chore: merge main into next' \
+              --body 'This pull request was created automatically because main could not be merged into next without conflicts.'
+          fi
+
+          echo 'main could not be merged into next without conflicts.'
+          exit 1