ci: various CI improvements (#312)

Author: drew

.github/workflows/e2e.yml

@@ -1,6 +1,8 @@
 name: E2E
 
 on:
+  push:
+    branches: [main]
   pull_request:
     types: [opened, synchronize, reopened, labeled]
 
@@ -10,15 +12,15 @@ permissions:
 
 jobs:
   build-gateway:
-    if: contains(github.event.pull_request.labels.*.name, 'e2e')
+    if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'e2e')
     uses: ./.github/workflows/docker-build.yml
     with:
       component: gateway
       platform: linux/arm64
       runner: build-arm64
 
   build-cluster:
-    if: contains(github.event.pull_request.labels.*.name, 'e2e')
+    if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'e2e')
     uses: ./.github/workflows/docker-build.yml
     with:
       component: cluster

.github/workflows/release-canary.yml

@@ -72,38 +72,10 @@ jobs:
           fi
 
       - name: Install CLI from GitHub Release
-        run: |
-          set -euo pipefail
-          TAG="${{ steps.release.outputs.tag }}"
-          ASSET_NAME="openshell-${{ matrix.target }}.tar.gz"
-          API="https://api.github.com/repos/${{ github.repository }}"
-
-          echo "Downloading ${ASSET_NAME} from release ${TAG}..."
-
-          # Look up the asset download URL via the releases API
-          ASSET_URL=$(curl -fsSL \
-            -H "Authorization: token ${GH_TOKEN}" \
-            "${API}/releases/tags/${TAG}" \
-            | jq -r --arg name "${ASSET_NAME}" \
-              '.assets[] | select(.name == $name) | .url')
-
-          if [ -z "$ASSET_URL" ] || [ "$ASSET_URL" = "null" ]; then
-            echo "::error::Asset ${ASSET_NAME} not found in release ${TAG}"
-            exit 1
-          fi
-
-          # Download the asset binary
-          curl -fsSL \
-            -H "Authorization: token ${GH_TOKEN}" \
-            -H "Accept: application/octet-stream" \
-            -o "/tmp/${ASSET_NAME}" \
-            "${ASSET_URL}"
-
-          tar -xzf "/tmp/${ASSET_NAME}" -C /tmp
-          install -m 755 /tmp/openshell /usr/local/bin/openshell
-          rm -f "/tmp/${ASSET_NAME}" /tmp/openshell
+        run: ./install.sh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENSHELL_VERSION: ${{ steps.release.outputs.tag }}
 
       - name: Verify CLI installation
         run: openshell --version

.github/workflows/release-tag.yml

@@ -31,6 +31,7 @@ jobs:
       cargo_version: ${{ steps.v.outputs.cargo }}
       # Semver without 'v' prefix (e.g. 0.6.0), used for image tags and release body
       semver: ${{ steps.v.outputs.semver }}
+      previous_tag: ${{ steps.prev.outputs.tag }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -50,6 +51,19 @@ jobs:
           echo "cargo=$(uv run python tasks/scripts/release.py get-version --cargo)" >> "$GITHUB_OUTPUT"
           echo "semver=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
+      - name: Find previous release tag
+        id: prev
+        run: |
+          set -euo pipefail
+          # List tags matching v*.*.* sorted by version descending, keep only
+          # stable releases (no pre-release suffixes like -rc1), skip the current tag
+          PREV=$(git tag --list 'v*.*.*' --sort=-version:refname \
+            | grep -P '^v\d+\.\d+\.\d+$' \
+            | grep -v "^${GITHUB_REF_NAME}$" \
+            | head -n1 || true)
+          echo "tag=${PREV}" >> "$GITHUB_OUTPUT"
+          echo "Previous release tag: ${PREV:-"(none, first release)"}"
+
   build-gateway:
     needs: [compute-versions]
     uses: ./.github/workflows/docker-build.yml
@@ -413,6 +427,8 @@ jobs:
           body: |
             ## OpenShell ${{ github.ref_name }}
 
+            ${{ needs.compute-versions.outputs.previous_tag != '' && format('**Full changelog**: [{0}...{1}](https://github.com/{2}/compare/{0}...{1})', needs.compute-versions.outputs.previous_tag, github.ref_name, github.repository) || '' }}
+
             ### Quick install
 
             Requires the [GitHub CLI (`gh`)](https://cli.github.com) to be installed and authenticated.

deploy/docker/Dockerfile.ci

@@ -49,6 +49,16 @@ RUN case "$TARGETARCH" in \
       -o /usr/local/lib/docker/cli-plugins/docker-buildx \
     && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
+# Install GitHub CLI used by install.sh and CI jobs
+ARG GH_VERSION=2.74.1
+RUN case "$TARGETARCH" in \
+      amd64) gh_arch=amd64 ;; \
+      arm64) gh_arch=arm64 ;; \
+      *) echo "Unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
+    esac \
+    && curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${gh_arch}.tar.gz" \
+    | tar xz --strip-components=2 -C /usr/local/bin "gh_${GH_VERSION}_linux_${gh_arch}/bin/gh"
+
 # Install AWS CLI v2 used for ECR publishing
 RUN case "$TARGETARCH" in \
       amd64) aws_arch=x86_64 ;; \