feat(ci): adopt ST release versioning and git tagging

[ddreyer]

Aligns the distroless build workflow with the release scheme used by startree-dex/st-release.yml: an upstream base version plus a StarTree build number.

base_version 0.49.0  +  build_number 1   ->   v0.49.0-ST-1

Inputs

Input	Default	Notes
base_version	0.49.0	Upstream Vector version this release is based on
build_number	1	StarTree build number
push	true	Uncheck for a build-only dry run

Replaces the old version / tag_suffix pair. Each release pushes .../vector:v<base>-ST-<n> and .../vector:latest, and creates a matching annotated git tag on the built commit.

base_version	build_number	git tag	image tags
0.49.0	1	v0.49.0-ST-1	.../vector:v0.49.0-ST-1, .../vector:latest
0.49.0	2	v0.49.0-ST-2	.../vector:v0.49.0-ST-2, .../vector:latest
0.57.0	1	v0.57.0-ST-1	.../vector:v0.57.0-ST-1, .../vector:latest

No git_ref input

The branch to build comes from the Run workflow dropdown. workflow_dispatch already sets github.ref, and actions/checkout with no ref: defaults to it, so the dropdown is the single source of truth. A separate git_ref input duplicated that and allowed dispatching the workflow definition from one branch while building source from another - a real footgun.

repository: startreedata/vector was dropped from the checkout steps at the same time: it was only there to pair with git_ref, and naming a repository explicitly changes how checkout resolves a missing ref.

New release job

Creates and pushes the annotated git tag and writes a run summary. Needs permissions: contents: write.

Two deliberate differences from the dex workflow

Tagging happens after publish, not before the build. Dex creates the git tag as an early step; here release runs needs: [metadata, build, publish], so a failed build cannot leave an orphan tag pointing at something never shipped.

metadata fails fast if the tag already exists. Reusing a build number is the obvious mistake, and without this you would not find out until git push origin <tag> at the very end - after ~90 minutes of build time. This is why metadata checks out with fetch-depth: 0.

Note on the build version

The build uses the plain upstream version to name the tarball. The Makefile writes vector-${VERSION}-<triple>.tar.gz and the distroless Dockerfile globs vector-0*, so the -ST-N suffix stays out of VERSION and belongs to the image tag only. metadata warns if base_version disagrees with Cargo.toml on the branch being built.

Follow-up

values.yaml in startree-metrics-agent pins v0.43.0-multiarch. New releases use -ST-N, so that pin needs updating to whatever the first release cuts.

🤖 Generated with Claude Code