[ianpittwood]

Partly addresses #851.

Summary

Adds an all-versions boolean input (default false) to bakery-build-native.yml and bakery-build.yml. When it is true, the matrix step skips --recent, so every release version is built. Callers keep recent: 3 and pass the dispatch input straight through:

recent: 3
all-versions: ${{ inputs.all-versions || false }}

This moves the complexity upstream, the same way refresh-cache did (#847/#850). Callers no longer need fromJSON(inputs.all-versions && '0' || '3'). The obvious expressions inputs.all-versions && 0 || 3 and inputs.recent || 3 silently evaluate to 3, because 0 is falsy in GitHub expressions.

• The input goes through env: (ALL_VERSIONS) and is never interpolated into run:.
• The matrix step is the only place recent is consumed. The build, merge and test jobs use the matrix's versions.
• toJSON(inputs) (cache-scope, artifact-scope hash) now includes the new key. Producers and consumers within a call hash it the same way, so this is harmless.
• bakery-build-pr.yml is intentionally unchanged. PR builds are fork-safe validation runs that never push, and a security rebuild is a manual production dispatch that uses the native/QEMU workflows.
• CI.md input tables now document recent, all-versions and the previously undocumented refresh-cache.

Verification

• actionlint passes on both workflows, and the pre-commit actionlint and zizmor hooks pass.
• bakery ci matrix --context ../images-connect --dev-versions exclude --matrix-versions exclude:
  • without --recent (what all-versions: true produces): connect 16, connect-content-init 16 (2025.05.0 to 2026.09.0)
  • with --recent 3: 3 each (2026.07.0 to 2026.09.0)

Downstream follow-up

The caller changes in #851 are still needed. In production.yml of each of these repos:

• images-connect
• images-package-manager
• images-workbench

Add a workflow_dispatch boolean input all-versions (default false, description e.g. "Build all release versions instead of only the 3 most recent [default: false]"). Then pass all-versions: ${{ inputs.all-versions || false }} to the shared workflow next to the existing recent: 3. Schedule and push runs see null inputs and still build 3. Downstream should also review the update-helm job's behavior and max-parallel for a run that is about 3 to 5 times larger (see the open questions in #851).

[github-actions]

Test Results

2 475 tests  ±0   2 475 ✅ ±0   14m 5s ⏱️ + 6m 21s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit 6a2b41a. ± Comparison against base commit b5fe395.

♻️ This comment has been updated with latest results.

[bschwedler]

Please use the existing recent input; 0 already builds all versions.

[bschwedler]

This input isn’t needed: recent: 0 already builds all versions. Callers can map the dispatch input to recent with fromJSON(inputs.all-versions && '0' || '3'). Please use the existing input instead.

[bschwedler]

Suggestion: Keep recent as the shared workflow’s only control and map the dispatch input at each caller instead:

recent: ${{ fromJSON(inputs.all-versions && '0' || '3') }}

This handles GitHub’s falsy-0 behavior while preserving the default of three versions for scheduled and push runs. The dispatch input can remain in the product workflows without adding an overlapping parameter here.