ci: updated branches and dev process

[Tbaile]

Proposal changes of dev processes

At the moment the dev process is as the following:

• Changes are applied into main that produces a DEV build. This dev build is used for testing only
• To release the packages, we need to bump the packages into the main, wait for a dev build to pass, then publish the packages manually. We lock this way merges to main until we're done publishing.
• To release an image, we tie it to a TAG, which is not the ideal given how OpenWRT acts on builds. Source code should be the truth of the build version and if we ever need to release a new image over the already published one we need to rewrite git history.

Current proposal is to automatically push the packages and images when merged to specified branches:

• main doesn't change, it's the dev branch and won't be touched, processes here happen as it always has been.
• pr pull request also don't actually change.
• testing introducing this branch to allow us to have a testing channel for some partners and/or specified machine we want test the not ready to release packages. This will be updated by merging the content of main or cherry-picking the changes.
• stable stable is to release packages to the public, stable channel. This can be used to release from testing or directly from main. Once this has been released it's needed to rebase main and testing to this branch, allowing changes already merged to be synced to the other channels.

When releasing to stable or testing images are not written over if they're already present in the remote channel. I've considered the need for a rewrite of the image a complete edge-case with no clear path forward at the moment. The solution to this is a manual build and manual copy. This can however be changed by adding a flag over the CI that forces the image push, not implemented at the moment.

TAGS: Tags have been removed from the build process, since I've noted above the need to rewrite history if a botched build is pushed. Releases, however are needed to be made to save the sbom and manifest.
My proposal is to use TAGS just for releases and tie them up to the stable branch instead of the main one.

Note: Not all documentation is up to date, if this draft goes forward I'll look into changing that, not applied at the moment due to uncertainty and changes to be applied if draft gets updated.

[Copilot]

Pull request overview

This PR updates NethSecurity’s CI/CD and documentation to support a branch-based release flow, adding testing and stable as automated publishing branches and removing the previous tag/manual “release stable packages” workflow approach.

Changes:

• Extend build-image workflow triggers to testing/stable, adjust version suffixing, and avoid overwriting existing stable/testing image artifacts.
• Remove legacy workflows for “release stable packages” and subscription syncing.
• Update docs and cleanup tooling to reflect the new version format and release process.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/cleanup/cleanup.py	Updates dev-build timestamp extraction to support the new prerelease segment format.
docs/development_process.md	Updates the documented stable release flow to branch-merge driven publishing and revises manual release guidance.
docs/build/index.md	Clarifies build defaults/variable behavior wording.
build.conf.defaults	Removes REPO_CHANNEL default from versioned defaults.
AGENTS.md	Updates CI/release documentation table and stable release steps (but needs a correction for PR builds).
.github/workflows/subscription.yml	Removes the workflow that synced stable → subscription on a schedule.
.github/workflows/release-stable.yml	Removes the manual dev → stable package sync workflow.
.github/workflows/cleanup-branch.yml	Adjusts cleanup logic to purge PR-numbered channels and exempts testing.
.github/workflows/build-image.yml	Implements branch-based publishing (main→dev, testing/stable→respective channels) and conditional image artifact upload.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.