What the developer wrote
Authored by Nicolas Dorier
Add publish-docker.sh
What changed, and why it matters
This commit adds a simple shell script used by BTCPay Server maintainers to automate creating and pushing a Git version tag when publishing Docker images. It does not change application code, user-facing behavior, or any security-sensitive logic. There is nothing in the commit that introduces a vulnerability or fixes one.
No security action required. If reviewing the release process, ensure only authorized maintainers can execute this script and that force-pushing tags is acceptable for the project's release policy.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The new publish-docker.sh script reads a version string from Build/Version.csproj, optionally appends a user-supplied suffix, then creates an annotated git tag and force-pushes it to origin. The script uses set -euo pipefail and operates on the local git repository. No application code, API, authentication, payment handling, or configuration is modified. The force-push is a maintainer workflow choice but is not a code vulnerability in this context.
Changed components
publish-docker.sh (new build/release helper script)Inspect captured patch +14 / −0
diff --git a/publish-docker.sh b/publish-docker.sh
new file mode 100755
index 0000000..d275763
--- /dev/null
+++ b/publish-docker.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+suffix="${1-}"
+
+if [[ -n "$suffix" ]]; then
+ suffix="-$suffix"
+fi
+
+ver="$(sed -n 's/.*<Version>\([^<]*\)<.*/\1/p' Build/Version.csproj | head -n 1)"
+
+git tag -a "v${ver}${suffix}" -m "${ver}${suffix}"
+git checkout master
+git push origin "v${ver}${suffix}" --force
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.