Publish summary: replace version links with live download-count badges

[felickz]

What

Each published/up-to-date cell in the publish.yml publish-summary table (shown in the workflow run summary and upserted into the corresponding GitHub Release notes) now renders a shields.io Dynamic Regex Badge instead of a plain [version](url) link:

• Label: the version/tag (e.g. 0.6.0)
• Value: the live download count for that specific tag (e.g. 2,559 downloads)
• Click-through: the badge image links to that version's GHCR package page (previously the plain-text link did this; now the badge does)
• The 🆕 "republished by this run" marker is preserved exactly as before.

Example rendering for codeql-cpp-queries @ 0.6.0:

How it works

The badge's url/search params point shields.io at GitHub's public .../pkgs/container/<package>/versions page (confirmed to hold full tag history, not just recent tags) and extract the download count for the specific tag via an RE2 regex. Shields fetches and scrapes this live, on every image render — there's no scraping infra, cron job, or stored data of our own to maintain. The count simply reflects whatever GitHub reports at view time (subject to shields.io's normal response caching).

Important caveat

This relies on shields.io's dynamic/regex badge type, which is explicitly documented upstream as "experimental: may change or be removed at any time." If it's ever removed/broken, affected cells would render as a broken image/invalid badge rather than failing the workflow. Documented this caveat in CONTRIBUTING.md alongside implementation notes.

Gotcha fixed along the way

Standard URL-encoders (jq's @uri, .NET's HttpUtility.UrlEncode, JS's encodeURIComponent) all leave * ( ) ' ! unescaped (RFC 2396 "mark" characters). Left as bare characters in a URL embedded in markdown, * can be misread as emphasis syntax and unbalanced (/) can prematurely close a markdown link's destination — silently corrupting the badge URL. Fixed by percent-encoding those explicitly on top of jq's @uri output (see url_encode() in build-publish-summary.sh).

Testing

• Validated the exact generated badge URLs render correctly (fetched live SVGs, confirmed labels/values/counts match GitHub's package page).
• Ran build-publish-summary.sh end-to-end against synthetic published/up-to-date/failed result fragments and confirmed the table output, including that the 🆕 marker still appears only for published status.
• bash -n syntax-checked the script.

Not in scope

Backfilling this new badge format onto historical releases' existing notes — this PR only changes what future publish.yml runs generate. Happy to follow up with a backfill pass separately if wanted.

[Copilot]

Pull request overview

Updates the publish.yml run summary generation to show per-tag GHCR download counts inline by rendering shields.io dynamic-regex badges in the publish-summary table (and documents the caveats of that approach in contributor docs). This improves the at-a-glance usefulness of the publish summary without introducing any first-party scraping or stored metrics.

Changes:

• Replace version hyperlink cells with shields.io dynamic-regex badges that scrape per-version download counts from GitHub’s public package versions pages.
• Add robust URL/regex percent-encoding helpers to avoid markdown URL corruption in generated summary markdown.
• Document the new badge behavior and its “experimental” dependency caveat in CONTRIBUTING.md.

Show a summary per file

File	Description
CONTRIBUTING.md	Documents the new publish-summary badge format, behavior, and reliability caveats, and links to the generating script.
.github/scripts/build-publish-summary.sh	Generates shields.io dynamic-regex badges (label=version, value=downloads) for published/up-to-date cells and updates the summary note accordingly.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Low

[felickz]

👍