Publish the production image instead of the Xdebug variant

[abnegate]

Problem

Every workflow builds with docker image build ... . and no --target. Docker defaults to the last stage, and the last stage is xdebug:

$ BUILDX_EXPERIMENTAL=1 docker buildx build --print=outline .
TARGET: xdebug

So every published appwrite/base image has shipped Xdebug since the variant was introduced in 1.2.0. Trivy and dive were also measuring that image rather than the one users actually run.

This is pre-existing on main, not introduced by the SHA-pinning work.

Why not reorder the stages instead

xdebug is FROM final, so it must be declared after final — which necessarily makes it last. Forward stage references don't resolve; Docker reinterprets the name as an external image:

ERROR: failed to solve: final: failed to resolve source metadata for
docker.io/library/final:latest: pull access denied, repository does not exist

An explicit --target is the only reliable control, so the README now documents it as required for local builds too.

Why CI never caught it

tests.yaml only ever asserted module presence. The Xdebug image satisfies every one of those assertions, so CI stayed green while shipping the wrong artifact. This PR adds an excludedOutput guard so the production image cannot silently regain Xdebug.

tests-xdebug.yaml has existed since 1.2.0 with no workflow consuming it; it is now wired into the structure-test workflow.

Why the variant is published rather than dropped

Downstream consumers do depend on the base providing xdebug.so. Appwrite's development stage copies a dev/xdebug.ini containing zend_extension=xdebug but never installs the extension itself, while its base/production stages strip Xdebug back out — compensating for this bug from both directions.

Nothing tracks a floating tag (consumers pin 1.4.4, 1.2.1, 1.2.0, 0.11.3, 0.5.0…), so this changes nothing retroactively. The variant is now published as <sha>-xdebug / <tag>-xdebug so those consumers have a real image to pin when they bump.

Changes

• --target final in all four build workflows (build-and-push, structure-test, dive, trivy)
• Build and push the Xdebug variant under -xdebug tags, per-arch plus manifests
• Wire tests-xdebug.yaml into structure-test.yml
• tests.yaml: assert Xdebug is absent
• README: document --target final as required

Verification

Both variants built locally on arm64:

Build	php -m
--target final	no xdebug; all 56 expected modules present
--target xdebug	xdebug present

Follow-up (not in this PR)

appwrite/appwrite should point its development stage at appwrite/base:<version>-xdebug before bumping its pin, otherwise --build-arg DEBUG=true builds will fail to load the extension.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR explicitly targets the production Docker stage throughout CI while separately building, testing, and publishing the Xdebug variant.

• Adds --target final to production builds used for publishing, structure tests, Dive, and Trivy
• Publishes architecture-specific and multi-architecture Xdebug tags
• Tests both variants and asserts that Xdebug is absent from production
• Documents the required explicit build target and records the release changes

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the scope of this follow-up review.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/build-and-push.yml	Production publishing now targets final, while Xdebug receives separate per-architecture images and manifests.
.github/workflows/dive.yml	Dive now measures the explicitly selected production stage.
.github/workflows/structure-test.yml	Structure tests now build and validate production and Xdebug images independently.
.github/workflows/trivy.yml	Trivy now scans the explicitly selected production stage.
tests.yaml	The production-image test suite now rejects images that expose the Xdebug module.
README.md	Local build documentation now requires an explicit production or Xdebug target.
CHANGES.md	The changelog documents the corrected production artifact and newly published Xdebug variant.

_{Reviews (2): Last reviewed commit: "(fix): publish production image instead ..." | Re-trigger Greptile}