fix: add cli-proxy container image to release workflow

[Copilot]

--enable-cli-proxy fails on any non---build-local run because the release workflow never builds/publishes the cli-proxy image to GHCR. The image reference in docker-compose resolves to a tag that doesn't exist:

No such image: ghcr.io/github/gh-aw-firewall/cli-proxy:0.25.14

Changes

• .github/workflows/release.yml — Add build-cli-proxy job (same pattern as build-api-proxy: multi-arch build+push, cosign signing, SBOM generation + attestation). Add it to the release job's needs array.
• docs/releasing.md — Add cli-proxy to image lists, verification checklist, local build examples, and package visibility reference.

Already in place (no changes needed)

• src/commands/predownload.ts — resolveImages() already includes cli-proxy when enableCliProxy is set (landed in feat: phase 1 – gh CLI proxy sidecar with mcpg DIFC proxy #1730)
• containers/cli-proxy/Dockerfile — exists from feat: phase 1 – gh CLI proxy sidecar with mcpg DIFC proxy #1730

[github-actions]

Documentation Preview

Documentation build failed for this PR. View logs.

Built from commit 2876709

[Copilot]

Pull request overview

This PR fixes release automation for the --enable-cli-proxy feature by ensuring the cli-proxy container image is built and published to GHCR as part of the release workflow, and updates release documentation accordingly.

Changes:

• Add a new build-cli-proxy job to .github/workflows/release.yml to build/push multi-arch cli-proxy images, sign them with cosign, and generate+attest an SBOM.
• Update the release job to depend on build-cli-proxy.
• Update docs/releasing.md to include cli-proxy in image lists, verification steps, and local build instructions.

Show a summary per file

File	Description
.github/workflows/release.yml	Adds CI job to publish cli-proxy image (multi-arch, cosign, SBOM) and wires it into the release dependencies.
docs/releasing.md	Documents cli-proxy as a release artifact and includes it in verification and local testing instructions.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0

[github-actions]

🧪 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	⚠️ pre-step vars not substituted

PR: fix: add cli-proxy container image to release workflow
Author: @Copilot | Assignees: @lpcox, @Copilot

Overall: PASS (core connectivity tests passed; file test skipped due to unrendered template variables)

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

Smoke Test: GitHub Actions Services Connectivity ✅

Check	Status
Redis PING (host.docker.internal:6379)	✅ PONG
PostgreSQL ready (host.docker.internal:5432)	✅ accepting connections
SELECT 1 on smoketest DB as postgres	✅ returned 1

All checks passed. (redis-cli was unavailable so Redis was tested via nc.)

🔌 Service connectivity validated by Smoke Services

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	ok	✅ PASS
Go	env	✅	ok	✅ PASS
Go	uuid	✅	ok	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	All passed	✅ PASS
Node.js	execa	✅	All passed	✅ PASS
Node.js	p-limit	✅	All passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Note: Java required mvn -Dmaven.repo.local=/tmp/gh-aw/agent/m2-repo since ~/.m2/ is owned by root in this runner environment.

Generated by Build Test Suite for issue #1774 · ● 427.9K · ◷

[github-actions]

Smoke test results (run 24112018856)

• ✅ GitHub MCP: "fix: add cli-proxy container image to release workflow" / "perf: optimize build-test workflow token usage"
• ✅ Playwright: github.com title contains "GitHub"
• ✅ File write: /tmp/gh-aw/agent/smoke-test-claude-24112018856.txt created
• ✅ Bash verify: file contents confirmed

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

🔮 The ancient spirits stir; this smoke-test agent has walked these halls.
The omens show mixed signs: some paths are clear, others are veiled by missing tools.
By starlight and stack trace, the oracle records this visit in run 24111984968.

🔮 The oracle has spoken through Smoke Codex