chore(CI): Tweak version handling for upstream releases

[mtodor]

Description

Standardize git tag format from v-prefixed (v0.1.0) to bare semver (X.Y.Z) for upstream releases. This aligns with Konflux conventions (which already use bare 0.2, 0.2.0 tags) and establishes a single well-defined format across build systems.

Changes:

• .github/workflows/build.yml: Update tag trigger pattern from v[0-9]+.[0-9]+.[0-9]+ to bare [0-9]+.[0-9]+.[0-9]+, and add support for X.Y.Z-rc.N pre-release tags. Update the latest image tag condition to use startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') — this is needed because the workflow also triggers on main pushes and PRs (so we must check it's a tag), and pre-release tags like 1.0.0-rc.1 should not overwrite latest.
• README.md: Update the Available Tags table to reflect bare 1.0.0 format instead of v1.0.0.

Validation

• make build succeeds
• make actionlint passes — workflow YAML is valid

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

Prompt: "Read and validate plan under: mt_nogit_tmp/PLAN_version_tag_format_XYZ.md (be sure that tagging with x.y.z-rc.n will also work for both GitHub action builds and konflux builds. For Konflux configuration you can check: konflux-release-data (search resources with name agentic-cluster-security-suite in directory or file name)"
Response: Validated the plan against actual codebase and Konflux release data. Found a bug in the proposed Makefile sed piping (breaks || echo "dev" fallback) and identified that -rc.N works for builds but not Konflux releases (no RC tag template in ReleasePlanAdmission).

Prompt: "Implement the plan"
Response: Applied changes to build.yml (tag trigger + latest condition), basic-component-pipeline.yaml (sed stripping), Makefile (sed stripping with fixed fallback), and README.md (tag format). Ran verification checks.

Prompt: "We don't need sed commands. We maybe have tags starting with 'v' in past, but we will not use them anymore"
Response: Removed sed 's/^v//' from both Makefile and Tekton pipeline. Simplified the change to only build.yml and README.md, since new bare tags will be picked up by git describe naturally.

Prompt: "Why we need this change: type=raw,value=latest,enable=..."
Response: Explained that the two-part condition is needed because: (1) the workflow triggers on main pushes and PRs too, so startsWith(refs/tags/) filters to tag pushes only; (2) !contains('-') prevents pre-release tags from overwriting latest.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 797a6d83-06f1-484b-aa59-9a7216a77fff

📥 Commits

Reviewing files that changed from the base of the PR and between 9eced44 and 11fc37f.

📒 Files selected for processing (2)

• .github/workflows/build.yml
• README.md

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Release builds now support standard semantic version and release candidate tags without a v prefix.
  • Stable version tags automatically receive the latest container image tag.

• Documentation

  • Updated container image examples to use version tags without the v prefix.

Walkthrough

The build workflow now accepts unprefixed semantic-version and release-candidate tags. It assigns the latest image tag to references without hyphens. The README documents unprefixed container image tags.

Changes

Version tag release flow

Layer / File(s)	Summary
Unprefixed release tag handling .github/workflows/build.yml, README.md	The workflow matches unprefixed semantic-version tags and release candidates. The latest tag applies to references without hyphens. The README updates the image tag example.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the CI changes for version handling and matches the pull request objectives.
Description check	✅ Passed	The description directly explains the Git tag, workflow, image tag, README, and validation changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mtodor/tweak-release-tags

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 100 times)

Stack Traces | 0s run time

- test violation 1
- test violation 2
- test violation 3

::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 100 times)

Stack Traces | 0s run time

- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[github-actions]

E2E Test Results

Commit: 11fc37f
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ list-clusters (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✗ cve-nonexistent (assertions: 3/3)
      one or more verification steps failed
  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)

Tasks:      10/11 passed (90.91%)
Assertions: 32/32 passed (100.00%)
Tokens:     ~51354 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  8499 tokens
  Output: 19559 tokens
Judge used tokens:
  Input:  30463 tokens
  Output: 31727 tokens

[janisz]

I don't like this change as it's not compatible with golang version convention :(
Maybe we can have 2 tags one with v and one without?

https://go.dev/doc/modules/version-numbers