Feature/branch builds for preview versions

[universe-ops]

Summary

• Add .github/workflows/branch-preview.yaml — a manually triggered (workflow_dispatch) workflow that builds and publishes a fully testable preview release of SC from any feature branch without touching the production latest pointers

What it does

Version: computed using the same reecetech/version-increment CalVer logic as push.yaml (with use_api: false to skip tag creation), then suffixed with -preview.{commit_sha} (e.g. 2026.04.07.3-preview.abc1234f).

SC binaries: built for all 3 platforms with the preview version embedded. Only versioned tarballs (sc-{os}-{arch}-v{version}.tar.gz) are uploaded to dist.simple-container.com — sc.sh and the version file are deliberately omitted, so no existing user running sc.sh without a pin gets the preview version. Users can install it with:

SIMPLE_CONTAINER_VERSION=<version> curl -s "https://dist.simple-container.com/sc.sh" | bash

Docker image: simplecontainer/github-actions:{version} is built from the branch and pushed to Docker Hub. latest and staging tags are not touched.

Git tag: a separate release/{version} branch is created from the current HEAD with all .github/actions/*/action.yml files patched to reference docker://simplecontainer/github-actions:{version} instead of :staging. A commit is made, tagged v{version}, and pushed — making the SC GitHub Actions usable at that exact version:

uses: simple-container-com/api/.github/actions/deploy-client-stack@v<version>

Build summary: on success, the workflow run's Summary tab shows copy-paste uses: blocks for all SC actions and the CLI install one-liner.

Job parallelism

prepare → build-setup → build-platforms ──────────────────────► publish-sc-preview ─┐
                      → build-binaries ─┬─► docker-build ──► publish-git-tag ────────┴─► finalize
                      → test ───────────┘

docker-build does not wait for build-platforms (the github-actions image doesn't need SC binaries). publish-sc-preview and publish-git-tag run in parallel.

Known risk

welder deploy -e prod in publish-sc-preview — if the dist stack does a full CDN sync it could delete sc.sh when it's absent from the preview bundle. Needs runtime validation; tracked in implementation notes.