Publish as a distroless container and add a major-version release tag

[Mpdreamz]

release-notes publishes to ghcr.io/nullean/release-notes as a distroless container image with a matching GitHub Action, and each release now also gets a floating major-version git tag.

Prompt summary: Add the same ghcr.io container publishing curb already has, wrap it in a GitHub Action that calls the container, and add a floating major-tag workflow so this repo can be pinned as a GitHub Action the way actions/checkout@v5 is.

Why

Every consumer of release-notes needed the .NET SDK installed to run it, even in CI, where a workflow step just wants to generate notes for a tag. curb solved this for itself in nullean/curb#72; this repo didn't have the equivalent yet. There was also no way to reference this repo as a GitHub Action pinned to a major version — only exact tags — so a consumer wanting automatic minor/patch updates within a major had nothing to pin to.

What

Container image

release-notes.csproj gains EnableSdkContainerSupport, and a new publishContainers target in Targets.fs runs dotnet publish -t:PublishContainer against the linux-x64 AOT build on top of mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled — no shell, minimal surface, correct for a binary with no managed runtime to host. Tags follow the same split curb uses: edge on every push to master, plus latest and the plain semver when the push is an exact release tag.

CI

The aot-pack matrix's linux-x64 leg now also builds the container image without pushing, purely to prove the build itself still works on every trigger. The build job logs in to ghcr.io and pushes for real, but only on push events, and only after the managed packages ship to GitHub Packages.

GitHub Action

A new action.yml at the repo root wraps docker://ghcr.io/nullean/release-notes:edge, taking command (generate, apply-labels, find-previous, current-version, or create-release), owner, repo, plus a passthrough args for everything else — so a workflow can generate release notes with a single uses: line and no SDK setup.

Major-version tag

A new create-major-tag.yml workflow runs on every published release and force-pushes a vN tag at that commit, so a workflow can pin uses: nullean/release-notes@v1 and follow every 1.x.y release automatically, the same way actions/checkout@v5 works.

Verify

docker run --rm ghcr.io/nullean/release-notes:edge generate --help

CI's aot-pack (linux-x64) leg proves the container still builds on every PR; the full push to ghcr.io only happens on a push to master or a release tag.

Made with Cursor