[bioinformatist]

Problem

Fixes #9965.

The published heartexlabs/label-studio:1.23.2 image reports
label_studio.__version__ == "1.23.0", causing the startup update notice even
after upgrading. Reproduced on Linux amd64 with the fixed image digest
sha256:afcc516a22775a39d0d66f4c2ddc95d01be3e3d3862b21fcf4f9de34b4ad4e12:

docker run --rm --entrypoint python3 \
  heartexlabs/label-studio@sha256:afcc516a22775a39d0d66f4c2ddc95d01be3e3d3862b21fcf4f9de34b4ad4e12 \
  -c 'import label_studio; print(label_studio.__version__)'
# 1.23.0

The runtime reads the installed distribution metadata. Promotion only copies
version_.py, leaving the candidate's project version and installed metadata
unchanged. Updating that file alone cannot fix the reported version. Its
generation also currently precedes the step that sets the version overrides.

Change

Update only .github/workflows/docker-release-promote.yml:

• Strip an optional leading v from the release tag and generate version_.py
  in the preparation step, with the overrides already set.
• Temporarily mount uv 0.12.3 to update the candidate's project version with
  uv version --frozen, then use the image's existing system pip to reinstall
  only Label Studio in editable mode into its application virtual environment.
  --no-deps preserves runtime dependencies; pip --python does not require
  pip to be installed in that target environment.
• Disable uv and pip caches for this operation, including pip subprocesses.
• Assert label_studio.__version__ against the normalized release version on
  each built image before exporting its digest for manifest publication.

This keeps promotion based on the tested candidate. It does not rebuild the
frontend, manually patch installed metadata, bootstrap an installer, or add uv
to the final image. Platform selection, tag selection and the manifest merge
job are unchanged. Editable installation uses the project's declared build
backend rather than assuming one backend's metadata layout.

Validation

Tested against base commit 097b2b2198f8db3ccfe80838d887fc77a67625e3, using
uv 0.12.3 and the regression image's existing pip 26.2.1.

• Extracted and executed the actual preparation shell from the workflow and
  built its generated Dockerfile on linux/amd64, substituting only the
  candidate FROM tag with the fixed regression digest above.
• Inputs 1.23.2, v1.23.2 and 1.23.2.post0 all passed the actual runtime
  assertion, reporting 1.23.2, 1.23.2 and 1.23.2.post0, respectively.
• Compared all three images with the baseline: 2,142 payload file hashes,
  170 other application distributions and one system distribution were
  unchanged. Project/version metadata had the expected changes, exactly one
  Label Studio distribution remained, and editable installation was preserved.
  No uv binary or additional cache files remained.
• Verified both the regression image's Poetry backend and the current source's
  uv_build backend. The latter installed successfully from read-only source
  into a pip-free virtual environment, reporting 1.24.0.dev0 with exactly one
  project distribution and without adding pip to that environment.
• YAML parsing and git diff --check passed. Compared the platform matrix,
  tag-selection logic and merge job with the baseline; all are unchanged.

These are local checks, not a completed release. Native arm64 execution and
the upstream release workflow still need validation. The added assertion must
pass on both platforms before their digests reach the dependent manifest job.
This PR does not change already-published images.

[netlify]

👷 Deploy request for label-studio-docs-new-theme pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	4857b7f

[netlify]

👷 Deploy request for heartex-docs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	4857b7f

[netlify]

✅ Deploy Preview for label-studio-storybook canceled.

Name	Link
🔨 Latest commit	4857b7f
🔍 Latest deploy log	https://app.netlify.com/projects/label-studio-storybook/deploys/6ad32bc21061fa01fa5ddeb5

[netlify]

✅ Deploy Preview for label-studio-playground canceled.

Name	Link
🔨 Latest commit	4857b7f
🔍 Latest deploy log	https://app.netlify.com/projects/label-studio-playground/deploys/6ad32bc2447fa430a01bb291

[bioinformatist]

@smohan123 A tiny PR.
Would you please take a glance at it?

[smohan123]

Our DevOps team will need to review this carefully before approving. I am unable to approve it for merge.

[farioas]

Sorry, that's not the right fix, it was my mistake when I pushed a security release in an old branch.
Will fix that in the next release.