fix: remove comment from bake-action set input

[fzipi]

Summary

Fixes the failure in release/20260705, the first release run after #447 merged.

docker/bake-action's set input is a plain newline-separated list of target.key=value overrides, not YAML — each line is passed straight to docker buildx bake --set. The explanatory comment added during #447's review (a #-prefixed line inside the set: | block) isn't a comment to bake --set, it's an invalid override key, and it broke every one of the 36 build jobs identically:

cannot parse bake definitions: ERROR: invalid override key # don't push tags; we do that at the end when all architectures have been built to, expected target.name

Moved the explanation to a real YAML comment above the step (outside the block scalar), where it can't be fed into bake --set.

Validation

• Reproduced the exact error locally: docker buildx bake --print ... --set "# don't push tags..." throws the identical invalid override key error.
• Confirmed the fix: same command without the comment line resolves cleanly.
• actionlint and zizmor pass clean.

Test plan

• Merge and trigger a real release; confirm all 36 build jobs and 12 merge jobs succeed and images publish correctly

AI Disclosure

Per the project's AI-Assisted Contribution Policy:

1. AI tools used: Claude (Sonnet 5, via Claude Code)
2. What was generated or assisted: Root-cause analysis of the release/20260705 failure from the linked Actions run log, and the fix (moving the explanatory comment out of the bake-action set block scalar).
3. Review performed: Reproduced the exact invalid override key error locally against the real docker-bake.hcl before writing the fix, then confirmed the corrected set block resolves cleanly with the same local reproduction. actionlint and zizmor both pass clean.

Summary by CodeRabbit

• Documentation
  • Clarified build-and-push release process notes to better explain how tags are handled during platform-specific builds and later applied safely.
  • Improved inline guidance around the release workflow without changing build behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9621e624-61df-41c6-b15b-e7263f9e5e21

📥 Commits

Reviewing files that changed from the base of the PR and between d72150c and b59674e.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

---

📝 Walkthrough

Walkthrough

This change relocates and rewords explanatory comments in the GitHub Actions publish workflow surrounding the per-platform "build and push by digest" step, clarifying that tags are cleared during build and applied later in a merge job to avoid a race condition. No functional behavior changes.

Changes

Publish Workflow Comment Update

Layer / File(s)	Summary
Relocate build-step comments .github/workflows/publish.yml	Added a multi-line comment before the build-and-push-by-digest step explaining tag clearing and merge-job tag application; removed the old inline comment near the tags= assignment.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• coreruleset/modsecurity-crs-docker#447: Both PRs modify the same publish.yml build-and-push-by-digest flow, with the related PR implementing the underlying mechanism these comments describe.

Suggested reviewers: theseion

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: removing an inline comment from the bake-action set input.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bake-set-comment-syntax-error

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}