ci: (managed beta) use release-candidate tags for AWS beta images

.github/workflows/build-ecr-aws-beta-manual.yaml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Development version, e.g. 0.5.0.dev9346005"
+        description: "Release-candidate image tag, e.g. 0.5.0-rc9346008"
         required: true
         type: string
       aws_commit:
@@ -64,14 +64,23 @@ jobs:
           path: source
           persist-credentials: false
 
+      - name: Validate release-candidate tag
+        env:
+          IMAGE_TAG: ${{ inputs.tag }}
+        run: |
+          if [[ ! "$IMAGE_TAG" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)-rc(0|[1-9][0-9]*)$ ]]; then
+            echo "Expected a release-candidate tag such as 0.5.0-rc9346008" >&2
+            exit 1
+          fi
+
       - name: Generate Metadata
         id: metadata
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5
         with:
           images: |
             ${{ vars.ECR_REGISTRY }}/${{ vars.ECR_REPOSITORY }}
           tags: |
-            type=raw,prefix=ecr-enterprise,value=${{ inputs.tag }},enable=true
+            type=raw,value=${{ inputs.tag }}
             type=raw,value=candidate
 
       - name: Set up QEMU

deployments/aws-extension-bundle.md

@@ -11,34 +11,21 @@ configured GitHub App to access `SpecterOps/openhound-aws`.
    the feature branch containing the changes you want. This selects both the
    OpenHound source and the bundle build tooling; the branch must include this
    version of the workflow.
-3. Set **`tag`** to a new development version such as `0.5.0.dev9346005`, without
-   `v` or `ecr-enterprise`. Coordinate versions with other publishers to the shared
-   ECR repository.
+3. Set **`tag`** to a unique release-candidate tag such as `0.5.0-rc9346008`,
+   without `v` or `ecr-enterprise`. In the numeric suffix, `9346` is the project
+   tracking ID and `008` is the release counter, starting at `000`; increment
+   the counter for each build. Coordinate versions with other publishers to the
+   shared ECR repository.
 4. Set **`aws_commit`** to the full **40-character SHA** of the AWS extension
    revision to bundle. Copy it from the desired commit in
    [openhound-aws history](https://github.com/SpecterOps/openhound-aws/commits/main/).
    This is required; the build rejects branches, tags, and abbreviated SHAs.
 5. Leave **`verify_access_only`** unchecked and run the workflow.
 
-### Beta version convention
-
-Use development versions to distinguish beta builds from stable releases. For
-example, `0.5.0.dev9346005` consists of:
-
-- `0.5.0`: the OpenHound base version.
-- `.dev`: the Python development-release marker used for these beta builds.
-- `9346`: the beta project's tracking identifier.
-- `005`: the release counter, starting at `000`; `005` is the sixth beta image
-  in this sequence.
-
-Increment the counter for each release and use a new version for each published
-build. This is a project naming convention; Python interprets the entire
-`9346005` suffix as one development-release number.
-
 The workflow builds the `enterprise` image for AMD64 and ARM64 and publishes:
 
 ```text
-${ECR_REGISTRY}/${ECR_REPOSITORY}:ecr-enterprise0.5.0.dev9346005
+${ECR_REGISTRY}/${ECR_REPOSITORY}:0.5.0-rc9346008
 ${ECR_REGISTRY}/${ECR_REPOSITORY}:candidate
 ```
 
@@ -60,20 +47,16 @@ Set `AWS_COMMIT_SHA` to the desired full AWS source commit SHA, then run:
 
 ```sh
 gh workflow run build-ecr-aws-beta-manual.yaml --ref main \
-  -f tag=0.5.0.dev9346005 -f aws_commit="$AWS_COMMIT_SHA"
+  -f tag=0.5.0-rc9346008 -f aws_commit="$AWS_COMMIT_SHA"
 ```
 
 Replace `main` with the OpenHound branch to build. Add
 `-f verify_access_only=true` for an access-only check. To include newer AWS
-extension changes, run again with the desired SHA and a new development version.
-
-Bundle preparation updates the AWS extension's OpenHound requirements to the
-selected OpenHound build version, regardless of the original version pins. It
-also pins the extension's boto3 requirements to the SDK version already installed
-by OpenHound's frozen dependency sync, regardless of the original AWS bounds.
-The helper reads the installed version rather than hard-coding an SDK version.
-Other requirements are preserved. Dependency resolution and `uv pip check` still
-run before publication; unresolved conflicts fail the build.
+extension changes, run again with the desired SHA and a new release-candidate tag.
+
+Bundle preparation aligns the AWS extension's OpenHound and boto3 requirements
+with the selected build environment, preserves other requirements, and fails
+before publication if dependency checks find conflicts.
 
 ## Deployment guidance