Publish as a distroless container and add a major-version release tag

[Mpdreamz]

assembly-rewriter publishes to ghcr.io/nullean/assembly-rewriter as a distroless container image with a matching GitHub Action, and each release now also gets a floating major-version git tag.

Prompt summary: Add the same ghcr.io container publishing curb already has, wrap it in a GitHub Action that calls the container, and add a floating major-tag workflow so this repo can be pinned as a GitHub Action the way actions/checkout@v5 is.

Why

Every consumer of assembly-rewriter needed the .NET SDK installed to run it, even in CI, where a workflow step just wants to rewrite a couple of DLLs. curb solved this for itself in nullean/curb#72; this repo didn't have the equivalent yet. There was also no way to reference this repo as a GitHub Action pinned to a major version — only exact tags — so a consumer wanting automatic minor/patch updates within a major had nothing to pin to.

What

Container image

assembly-rewriter.csproj gains EnableSdkContainerSupport, and a new publishContainers target in Targets.fs runs dotnet publish -t:PublishContainer against the linux-x64 AOT build on top of mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled — no shell, minimal surface, correct for a binary with no managed runtime to host. Tags follow the same split curb uses: edge on every push to master, plus latest and the plain semver when the push is an exact release tag.

CI

The aot-pack matrix's linux-x64 leg now also builds the container image without pushing, purely to prove the build itself still works on every trigger (this leg does print pre-existing ILRepack/Mono.Cecil trim warnings during the AOT compile — expected, and unrelated to this change). The build job logs in to ghcr.io and pushes for real, but only on push events, and only after the managed packages ship to GitHub Packages.

GitHub Action

A new action.yml at the repo root wraps docker://ghcr.io/nullean/assembly-rewriter:edge, taking a single passthrough args input for the full -i/-o pair list this tool already expects — so a workflow can rewrite an assembly with a single uses: line and no SDK setup.

Major-version tag

A new create-major-tag.yml workflow runs on every published release and force-pushes a vN tag at that commit, so a workflow can pin uses: nullean/assembly-rewriter@v1 and follow every 1.x.y release automatically, the same way actions/checkout@v5 works.

Verify

docker run --rm ghcr.io/nullean/assembly-rewriter:edge --help

CI's aot-pack (linux-x64) leg proves the container still builds on every PR; the full push to ghcr.io only happens on a push to master or a release tag.

Made with Cursor