Releasing

A release is a v* tag on main. Two workflows fire on the tag push:

• Publish container images (docker-publish.yml): builds, signs (keyless), generates an SBOM and Trivy-scans ghcr.io/zyvorai/atlas (Dockerfile), atlas-ceph (Dockerfile.ceph) and atlas-io-agent (Dockerfile.io).
• Release (release.yml): GitHub Release with the matching CHANGELOG.md section, atlasctl and atlas-mac-agent archives for common platforms (macOS included), the UI bundle and SHA256SUMS.

Steps

1. Branch release/X.Y.Z from main. Move ## [Unreleased] entries under ## [X.Y.Z] — date in CHANGELOG.md.
2. Bump the version in: Cargo.toml (workspace) and the workspace members in Cargo.lock, README.md badge, docs/DEPLOYMENT.md, docs/STATUS.md, both Helm Chart.yaml (version/appVersion), crates/atlas-gateway/ui/package*.json, website/package*.json. Check with cargo metadata --locked.
3. Open the PR, merge it.
4. Tag the merge commit (git tag -a vX.Y.Z -m vX.Y.Z) and push the tag.
5. Wait for both workflows. Then bump the atlas-io-agent image in deploy/k8s/atlas-io-agent*.yaml in a follow-up PR; never deploy the floating :latest.

ghcr visibility

Visibility is per package, not per tag. atlas, atlas-ceph and atlas-io-agent are public, so new tags are public as soon as they are pushed and nodes pull anonymously. A package that has never been published starts private: set it to public once under the organisation's Packages settings.

Notes

• Runners can queue for a long time; the tag is not "released" until both workflows are green.
• Pre-pull a new image on a node before rolling a DaemonSet to it (k3s ctr -n k8s.io images pull), because a failed pull kills the old pod first.