fix(release): also move the latest docker manifest on versioned releases

[oleksandrd-flamingo]

Description

Dispatch-triggered releases (workflow_dispatch → DOCKER_TAG=<version>, see release.yml:204) push only the versioned image tags (0.2.9, 0.2.9-amd64, 0.2.9-arm64). The latest manifest is only produced when DOCKER_TAG itself is latest (push-triggered builds), so the tag froze on 2026-06-24 while versioned releases kept shipping.

Dev environments are built around latest: values-dev.yaml pins imageTag: latest with Keel poll annotations. With latest frozen, Keel never sees a digest change and kubectl rollout restart faithfully re-pulls the same two-week-old image — dispatch-built images (including the 0.2.9 cpe.sqlite self-heal fix from #68) never reach dev.

Fix: a second docker_manifests entry in .goreleaser.yml that publishes fleet:latest from the same per-arch images built for the versioned tag. It is skipped when DOCKER_PUSH=false or when DOCKER_TAG is already latest (would duplicate the first manifest).

Improvements

• .goreleaser.yml: publish the latest multi-arch manifest alongside the versioned one on dispatch releases; no extra builds — it references the already-pushed -amd64/-arm64 images.

Task

Follow-up to #68 / release 0.2.9 — unblocks dev (Keel + imageTag: latest) from receiving dispatch-built images.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added a Docker latest manifest so the published image now includes a stable latest tag.
  • Improved release behavior to avoid unnecessary duplicate pushes when latest is already being used or image pushing is disabled.

[coderabbitai]

Warning

Review limit reached

@oleksandrd-flamingo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 965882bd-c4f6-4843-a566-f254369298f5

📥 Commits

Reviewing files that changed from the base of the PR and between f49d3bf and 2d66d76.

📒 Files selected for processing (1)

• .goreleaser.yml

Walkthrough

This change updates the `.goreleaser.yml` release configuration by adding a new `docker_manifests` entry for the `latest` tag. The manifest targets `fleet:latest` and references existing `amd64`/`arm64` per-architecture image templates based on `DOCKER_TAG`. A `skip_push` condition is included to prevent pushing when `DOCKER_PUSH` is `"false"` or when `DOCKER_TAG` is already `"latest"`.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main release change to publish the latest Docker manifest on versioned releases.
Description check	✅ Passed	The description matches the template with Description, Improvements, and Task sections and provides a clear summary of the change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-push-latest-manifest

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}