fix(ci): isolate self-host init image publishing

[izadoesdev]

Change

The new self-host init image shared the hosted image build matrix, so an init-only build or signing failure could block every hosted image manifest.

Run init publishing in its own workflow invocation. It reuses the existing publisher with init-only: true, an independent concurrency group, and the same native amd64/arm64 builds, tags, vulnerability scans, signatures, provenance, and SBOM. The hosted service list and affected-service behavior return to their pre-self-host state. Existing hosted build and manifest steps are unchanged.

Validation

• bun run lint, bun run check-types (33 tasks), and bun run test (29 tasks) pass.
• actionlint 1.7.12 validates both workflows.
• Executed the original and updated detection scripts against 81 combinations of caller mode, event, base SHA, and affected services; hosted outputs match, and init calls select only init.
• Compared parsed hosted build/manifest/result jobs with the pre-init workflow; only the init description differs.

No application code, deployment, or release publication. No dependency on the separate runtime isolation PR. Existing Dependabot PRs #699 and #702 also update action pins in the publisher; this change preserves current pins.

---

Summary by cubic

Separates self-host init image publishing from the hosted build matrix so an init-only build or signing failure can no longer block hosted image manifests.

• The new docker-publish-init.yml workflow calls the existing publisher with init-only: true and gets its own concurrency group.
• The hosted workflow removes init from the service list and stops forcing it into affected-service detection.
• Hosted build, manifest, and signing steps are unchanged.

^{Written for commit b5334de. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dashboard	Ready	Preview	Sep 17, 2026 9:17am UTC
databuddy-status	Ready	Preview	Sep 17, 2026 9:17am UTC
documentation	Ready	Preview	Sep 17, 2026 9:17am UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 10cbd003-1c0a-44f1-953f-765769e1a191

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the isolated init invocation preserves publication behavior without interfering with hosted image runs.

Summary

This PR separates publishing the self-host init image from hosted service publication while continuing to reuse the existing image publisher.

• Adds an independently triggered workflow that calls the publisher with init-only: true.
• Gives init publication a separate concurrency group.
• Restores hosted affected-service detection without forcing init into its build matrix.
• Preserves the existing multi-architecture build, scan, signing, provenance, SBOM, and manifest behavior.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    E[Push, release, or manual dispatch] --> H[Hosted publisher]
    E --> I[Self-host init caller]
    H --> D1[Detect affected hosted services]
    I --> C[Call publisher with init-only true]
    C --> D2[Select init service]
    D1 --> B1[Build hosted amd64 and arm64 images]
    D2 --> B2[Build init amd64 and arm64 images]
    B1 --> M1[Publish hosted manifests]
    B2 --> M2[Publish init manifest]
    M1 --> G1[Concurrency group docker-ref]
    M2 --> G2[Concurrency group docker-ref-init]

Loading

_{Reviews (1) · Last reviewed commit: "fix(ci): isolate self-host init image pu..."}