Summary

Stable release binaries built via Docker cross-compilation (macOS CLI, Linux/macOS Python wheels) were baking DEFAULT_IMAGE_TAG = "dev" instead of the release semver. This caused these binaries to pull dev-tagged Docker images instead of the version-pinned stable images.

Related Issue

N/A (discovered via investigation)

Changes

• Added ARG OPENSHELL_IMAGE_TAG to Dockerfile.cli-macos, Dockerfile.python-wheels, and Dockerfile.python-wheels-macos
• The CI workflows and build scripts already pass OPENSHELL_IMAGE_TAG as a --build-arg, but without the ARG declaration in the Dockerfile, Docker silently drops it
• Rust's option_env!("OPENSHELL_IMAGE_TAG") reads the env at compile time; without the ARG, it gets None and falls back to "dev"

Root Cause

crates/openshell-bootstrap/src/image.rs defines:

pub const DEFAULT_IMAGE_TAG: &str = match option_env!("OPENSHELL_IMAGE_TAG") {
    Some(tag) => tag,
    None => "dev",
};

Docker ARG values are available as env vars during RUN commands, but only if declared. The three affected Dockerfiles declared ARG OPENSHELL_CARGO_VERSION (for version patching) but not ARG OPENSHELL_IMAGE_TAG (for image tag baking).

Affected Artifacts

Testing

• mise run pre-commit passes (one unrelated test failure due to local port conflict)
• Unit tests added/updated
• E2E tests added/updated (if applicable)

The fix is a Dockerfile-only change with no runtime code changes. Verification requires a tagged release build to confirm the baked-in tag is correct.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)