How do I avoid installing pre-release version from github release?

[criyle]

ghcr.io/devcontainers-extra/features/protoc uses the gh-release to download the latest protoc but protobuf have pre-release versions like v33.0-rc1. How do I avoid install pre-release versions when tagged with latest. Is there a flag to filter out pre-release versions?

[koralowiec]

Hi!

Currently there's no specific flag to filter out the pre-releases. I have that in plans, but I lack time unfortunately

However, there's a workaround which we sometimes use in devcontainers-extra/features: releaseTagRegex. With this flag it's possible to filter out releases which contain a specific set of words.

For example, we use it for ocaml-opam feature to filter out releases which contain alpha, beta or rc words:

$nanolayer_location \
    install \
    devcontainer-feature \
    "ghcr.io/devcontainers-extra/features/gh-release:1.0.25" \
    --option repo='ocaml/opam' --option binaryNames='opam' --option version="latest" --option releaseTagRegex='^(?!.*(alpha|beta|rc)).*$'

I guess we can do a similar temporary workaround for protoc feature as well (until there's a proper pre-release filter)

[skevetter]

@criyle, in case you're interested, (excuse my small plug) I have been working on picolayer, a CLI tool meant to be a drop-in replacement for nanolayer. The gh-release argument excludes pre-releases by default. You can see another example here.

PICOLAYER_LOG_LEVEL=info sudo -E ./picolayer gh-release --owner ocaml --repo opam --verify-checksum --gpg-key https://opam.ocaml.org/opam-dev-pubkey.pgp
[2025-10-23T16:11:36Z INFO  picolayer] Starting picolayer
[2025-10-23T16:12:37Z INFO  picolayer::installers::gh_release::client] Skipping prereleases, using stable release: 2.4.1
[2025-10-23T16:12:37Z INFO  picolayer::installers::gh_release] Installing from release: 2.4.1
[2025-10-23T16:12:37Z INFO  picolayer::installers::gh_release] Selected asset: opam-2.4.1-x86_64-linux
[2025-10-23T16:11:37Z INFO  picolayer::installers::gh_release::verifier] GPG signature verification passed!
...
[2025-10-23T16:11:37Z INFO  picolayer::installers::gh_release::extractor] Installed raw binary: opam -> /usr/local/bin/opam
[2025-10-23T16:11:37Z INFO  picolayer::installers::gh_release] Installation complete!

Usage: picolayer gh-release [OPTIONS] --owner <OWNER> --repo <REPO>

Options:
      --owner <OWNER>
          Repository owner
      --repo <REPO>
          Repository name
      --binary <BINARY>
          Comma-separated list of binary names
      --version <VERSION>
          Version to install (default: latest) [default: latest]
      --install-dir <INSTALL_DIR>
          Directory to install binaries [default: /usr/local/bin]
      --filter <FILTER>
          Regex pattern for asset filtering
      --verify-checksum
          Verify checksums using checksum files
      --checksum-text <CHECKSUM_TEXT>
          Checksum text for verification (e.g., "sha256:5d3d3c60ffcf601f964bb4060a4234f9a96a3b09a7cdf67d1e61ae88efcd48f4")
      --gpg-key <GPG_KEY>
          GPG public key for signature verification (can be a URL, file path, or key content)
      --include-prerelease
          Include prerelease versions