fix(build): use FullCommit in goreleaser to match CI image tags

[mchmarny]

Summary

Switch goreleaser ldflags from {{.ShortCommit}} (7 chars) to {{.FullCommit}} (40 chars) so dev-build image tags match what on-push.yaml actually pushes.

Motivation / Context

PR #655 added commit-based image resolution for dev builds, but the CLI receives a 7-char ShortCommit via goreleaser while CI tags images with the full 40-char github.sha. The resulting :sha-<7chars> tag doesn't exist in the registry, causing ImagePullBackOff.

Fixes: #655
Related: #654

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• Build/CI/tooling

Component(s) Affected

• CLI (cmd/aicr, pkg/cli)
• API server (cmd/aicrd, pkg/api, pkg/server)
• Recipe engine / data (pkg/recipe)
• Bundlers (pkg/bundler, pkg/component/*)
• Collectors / snapshotter (pkg/collector, pkg/snapshotter)
• Validator (pkg/validator)
• Core libraries (pkg/errors, pkg/k8s)
• Docs/examples (docs/, examples/)
• Other: ____________

Implementation Notes

• .goreleaser.yaml lines 34 and 69: {{.ShortCommit}} → {{.FullCommit}} for both aicr and aicrd builds
• Added TestResolveImageCIContract that documents the full-vs-short SHA dependency and will catch future drift
• Cosmetic trade-off: aicr --version now prints a 40-char SHA instead of 7

Testing

go test -race ./pkg/validator/catalog/...
golangci-lint run -c .golangci.yaml ./pkg/validator/catalog/...

All tests pass, zero lint issues. New TestResolveImageCIContract verifies full SHA produces a different (correct) tag than short SHA.

Risk Assessment

• Low — Isolated change, well-tested, easy to revert

Rollout notes: No migration needed. Only affects the commit string baked into binaries at build time. Release builds are unaffected (version tag takes precedence over commit).

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)

[github-actions]

Coverage Report ✅

Metric	Value
Coverage	74.6%
Threshold	70%
Status	Pass

Coverage Badge

![Coverage](https://img.shields.io/badge/coverage-74.6%25-green)

No Go source files changed in this PR.

[njhensley]

This PR nominally does one thing (flip ShortCommit → FullCommit) but its diff contains two logically separate changes:

1. The stated fix — .goreleaser.yaml + a new contract test. Exactly what we wanted coming out of #655. ~10 lines.
2. An unannounced release-workflow refactor — removes bump-prepare/bump-finalize/bump-abort, adds bump-promote and a new tools/changelog script, stops committing CHANGELOG.md, rewrites RELEASING.md + site/docs/project/releasing.md. ~170 lines across 6 files.

The PR title, description, and checked "Type of Change" cover only (1). A reviewer focused on the #655 fix will approve without noticing (2).

Recommendation: split into two PRs. The FullCommit fix is tiny and should land immediately. The release refactor deserves its own title, description, and review — the RC-to-stable same-SHA promotion flow is genuinely useful, but it has edge cases (see inline) that shouldn't ride in under an unrelated bugfix.

If you'd rather keep it bundled, at minimum update the PR description and title to cover both changes, and consider whether it should land as a merge commit (preserve the two logical commits) rather than a squash (collapses to an understated title).

Other repo-state concern not easily anchored inline: CHANGELOG.md is now orphaned. After this PR, nothing updates it, but it still sits in the repo. Either delete it or prepend a header noting it's historical and that current release notes live in GitHub Releases.

Inline comments cover the specifics.

[coderabbitai]

♻️ Duplicate comments (1)

tools/changelog (1)

21-24: ⚠️ Potential issue | 🟠 Major

Grep pipeline can abort the script when output is empty.

Under set -euo pipefail, if git-cliff produces no output or all lines are filtered by the grep chain, the pipeline exits with code 1 and the script aborts. This was flagged in a previous review and remains unaddressed.

Consider appending || true to the pipeline or replacing the grep chain with a single awk that doesn't fail on empty input:

🛠️ Proposed fix using `|| true`

 # Generate raw changelog, strip noise lines
-RAW=$(git-cliff --unreleased --strip header \
-  | grep -v '<!-- .* -->' \
-  | grep -vi 'Signed-off-by:' \
-  | grep -vi 'Co-authored-by:')
+RAW=$(git-cliff --unreleased --strip header \
+  | grep -v '<!-- .* -->' \
+  | grep -vi 'Signed-off-by:' \
+  | grep -vi 'Co-authored-by:' || true)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tools/changelog` around lines 21 - 24, The pipeline assigning RAW can fail
under set -euo pipefail if git-cliff yields no lines and the grep chain exits
nonzero; update the assignment that uses `git-cliff --unreleased --strip header
| grep -v '<!-- .* -->' | grep -vi 'Signed-off-by:' | grep -vi
'Co-authored-by:'` so it never causes the script to abort—either append `||
true` to the pipeline or replace the grep chain with a single awk filter that
safely handles empty input; ensure the variable RAW remains set (possibly to an
empty string) when no lines match.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@tools/changelog`:
- Around line 21-24: The pipeline assigning RAW can fail under set -euo pipefail
if git-cliff yields no lines and the grep chain exits nonzero; update the
assignment that uses `git-cliff --unreleased --strip header | grep -v '<!-- .*
-->' | grep -vi 'Signed-off-by:' | grep -vi 'Co-authored-by:'` so it never
causes the script to abort—either append `|| true` to the pipeline or replace
the grep chain with a single awk filter that safely handles empty input; ensure
the variable RAW remains set (possibly to an empty string) when no lines match.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 300ac19d-4d34-40ab-be0c-714d2067e22a

📥 Commits

Reviewing files that changed from the base of the PR and between e5d3a56 and 749d84d.

📒 Files selected for processing (3)

• pkg/validator/catalog/catalog_test.go
• tools/bump
• tools/changelog

[njhensley]

Follow-up fixes address all four inline comments cleanly: contract test now actually enforces FullCommit in .goreleaser.yaml, || true replaces || "", unknown cliff.toml groups are emitted instead of dropped, and cmd_promote verifies the RC SHA is an ancestor of origin/main (plus tightens tag lookup to refs/tags/). LGTM.