ShakerScan Release Mapping

This file tracks the best-known git commit that produced each published Docker image tag. pending is reserved for a future release row before its final commit exists. unverified legacy provenance means an older image exists but its exact build commit was not preserved; do not replace that label with a guessed tag commit.

The hosted installer resolves install/STABLE_VERSION, then downloads runtime files from the matching immutable v<version> tag. Advance that channel only after all release manifests exist. Release notes and image labels record both the candidate source commit and the workflow-definition commit; these can differ for an explicitly dispatched candidate build. Installed runtimes default to the immutable image tag recorded in their downloaded VERSION file. Use ./scanner.sh start --image-tag latest only when you intentionally want the moving tag. The hosted installer still downloads runtime docs/scripts from its configured raw source, so the generated launcher also pins SCANNER_IMAGE_TAG to the downloaded version by default.

Repository tags v0.5.0 through v0.5.4 exist, but their published image provenance was not recorded in this ledger. Verify Docker registry history and build metadata before adding them; a git tag alone does not prove which commit produced an image.

Release Workflow

Dispatch the candidate only after "Build candidate on main" has succeeded for the exact SHA. The release-candidate workflow reuses that run's attested image set and skips its own 40-minute rebuild; dispatched earlier it finds nothing and rebuilds. A tests-only or docs-only merge does not trigger the main build (its path filter excludes tests/**), so dispatch it by hand first: gh workflow run build-on-main.yml -f sha=<candidate_sha>. On 2026-09-18 two candidates were dispatched minutes after their pushes and rebuilt everything: 64 minutes each instead of about 20.

The release process itself is documented once, in docs/release-process.md: protected main with required pre-merge checks, one immutable Release candidate build per exact SHA, Promote release by digest, public smoke, and a separate stable-channel bump. This file is only the provenance ledger.

Version 2.2.0 is the pending candidate: safe upgrades (ordered secrets, foreign-install refusal, the release image lock honored by the launcher itself), the fifth image handled by every lifecycle and release path, and the DAST profile ladder, per-attempt calibration, and bounded continuation rounds. It has not been published or promoted.

Ledger rules:

• Add a row with pending candidate when VERSION changes; replace it with the tagged commit SHA and the published image digests only after Promote release succeeds, in a provenance-only release: commit.
• Record failed or cancelled candidates as such. A version number that never published stays in the table so nobody reuses it.
• scripts/upgrade_smoke.sh reads the previous-stable digests from this table through scripts/release_ledger.py; a stable version without digests here fails the upgrade gate.
• Publishing this repository or the Docker images does not update install.shakerscan.com. The hosted installer follows install/STABLE_VERSION, which moves only through the stable-channel pull request prepared by Promote stable channel.

Manual image publishing remains available from a clean checkout for emergency rebuilds only:

scripts/publish-images.sh --push --latest --platform linux/amd64,linux/arm64

It bypasses candidate certification and must never be the normal path.