feat(versioncheck): add stable-tag filter and CI auto-merge

Skip pre-release tags (alpha, beta, rc, dev, pre, snapshot, experimental)
and floating tags (latest, nightly, canary, edge) when selecting the latest
image version. Fetch up to 25 tags and pick the first stable one.

Add build, lint, and test steps to the version-update workflow before
creating the PR. Enable auto-merge via gh pr merge --auto --squash so the
PR lands automatically when all required checks pass.

Context: reviewed tag patterns across registries to identify common
pre-release naming conventions. Verified isStableTag handles TRON's
GreatVoyage- prefix correctly (prefix is stripped before the check).

Author: tazhate

.github/workflows/version-update.yml

@@ -11,6 +11,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+
     steps:
       - uses: actions/checkout@v4
 
@@ -25,7 +26,19 @@ jobs:
           # Optional: set to avoid Docker Hub anonymous rate limits (600 req/h)
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Create PR if versions changed
+      - name: Verify build after update
+        run: go build ./...
+
+      - name: Run linter
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.11.4
+
+      - name: Run tests
+        run: go test ./internal/... ./api/...
+
+      - name: Create PR
+        id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
           commit-message: |
@@ -37,11 +50,19 @@ jobs:
           body: |
             ## Automated image version update
 
-            `cmd/versioncheck` found newer tags in upstream registries and updated
+            `cmd/versioncheck` found newer stable tags in upstream registries and updated
             `internal/adapters/versions_gen.go`.
 
-            **Review the diff before merging** — verify each updated image is a
-            stable release (not a pre-release or breaking change).
+            Pre-releases (alpha/beta/rc), nightly and floating tags (latest, canary)
+            are automatically skipped.
+
+            Build, lint and tests passed. Safe to auto-merge.
           branch: chore/update-node-images
           delete-branch: true
           labels: dependencies
+
+      - name: Enable auto-merge
+        if: steps.cpr.outputs.pull-request-number
+        run: gh pr merge --auto --squash "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

cmd/versioncheck/main.go

@@ -119,7 +119,7 @@ func checkVersions(ctx context.Context, filterChain string, concurrency int, tim
 				return
 			}
 
-			tags, err := client.LatestTags(reqCtx, it.policy, 5)
+			tags, err := client.LatestTags(reqCtx, it.policy, 25)
 			if err != nil {
 				res.Err = err
 				mu.Lock()
@@ -128,9 +128,13 @@ func checkVersions(ctx context.Context, filterChain string, concurrency int, tim
 				return
 			}
 
-			if len(tags) > 0 {
-				res.LatestTag = tags[0].Tag
-				res.IsNewer = registry.IsNewer(res.LatestTag, res.CurrentTag, it.policy.TagPrefix)
+			// Pick the latest stable tag (skip pre-releases, nightly, latest, etc.)
+			for _, t := range tags {
+				if isStableTag(t.Tag, it.policy.TagPrefix) {
+					res.LatestTag = t.Tag
+					res.IsNewer = registry.IsNewer(res.LatestTag, res.CurrentTag, it.policy.TagPrefix)
+					break
+				}
 			}
 
 			mu.Lock()
@@ -193,6 +197,28 @@ func applyUpdates(updates []versionResult) error {
 	return writeVersionsGen(genPath, images)
 }
 
+// isStableTag reports whether tag is a stable release — not a pre-release, nightly, or floating tag.
+// prefix is stripped before the check (e.g. "GreatVoyage-" for TRON).
+func isStableTag(tag, prefix string) bool {
+	stripped := strings.TrimPrefix(tag, prefix)
+	lower := strings.ToLower(stripped)
+	// Reject floating / non-versioned tags
+	floating := []string{"latest", "nightly", "canary", "edge", "develop", "main", "master", "unstable"}
+	for _, f := range floating {
+		if lower == f {
+			return false
+		}
+	}
+	// Reject pre-release suffix keywords that appear after a "-"
+	preRelease := []string{"-alpha", "-beta", "-rc", "-dev", "-pre", "-snapshot", "-test", "-experimental"}
+	for _, p := range preRelease {
+		if strings.Contains(lower, p) {
+			return false
+		}
+	}
+	return true
+}
+
 // parseTag extracts the tag from an image reference (everything after the last ":").
 func parseTag(imageRef string) string {
 	if i := strings.LastIndex(imageRef, ":"); i >= 0 {