ci: expand container publishing workflows

.github/workflows/publish-baseline.yml

@@ -7,9 +7,14 @@ name: Publish Baseline
 # Triggers:
 #   - workflow_dispatch: run manually from any branch; pick a tag via the input
 #     (default: "baseline") e.g. "baseline", "1.0.0-baseline"
-#   - push of `v*` tags (e.g., `v1.0.1`) -> docker tag derived as `1.0.1-baseline`
-#     (so cutting a release builds both `:1.0.1` and `:1.0.1-baseline` in one push)
-#   - push of `*-baseline` tags (e.g. `1.0.0-baseline`) → docker tag mirrors git tag
+#   - push of `v*` tags (e.g., `v1.0.1`) -> docker tag derived as `1.0.1-baseline`.
+#     publish.yml handles `:1.0.1`/`:latest` for the same push (it excludes
+#     `v*-baseline` so this workflow owns the baseline half of every release).
+#     This workflow also moves the rolling `:baseline` pointer.
+#   - push of `v*-baseline` or `*-baseline` tags (e.g., `v1.0.1-baseline`,
+#     `1.0.1-baseline`) -> docker tag mirrors the git tag (v stripped).
+#     publish.yml explicitly excludes `v*-baseline` so a baseline-only release
+#     does not also push `:X.Y.Z` or `:latest`. Rolling `:baseline` is moved.
 
 on:
   workflow_dispatch:
@@ -112,15 +117,18 @@ jobs:
           if [[ "${{ github.event_name }}" == "push" ]]; then
             REF="${GITHUB_REF_NAME}"
             if [[ "${REF}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              # Versioned release tag (e.g., v1.0.1) -> derive `1.0.1-baseline`
+              # Versioned release tag (e.g., v1.0.1) -> derive `1.0.1-baseline`.
+              # publish.yml handles `:1.0.1`/`:latest` for the same push.
               TAG="${REF#v}-baseline"
             elif [[ "${REF}" =~ ^v.*-baseline$ ]]; then
-              # Should never happen given trigger patterns, but guard so we
-              # never produce a literal `v1.0.1-baseline-baseline` docker tag.
-              echo "::error::Tag '${REF}' mixes both conventions. Push the bare vX.Y.Z tag - publish.yml handles :1.0.1, this workflow handles :1.0.1-baseline."
-              exit 1
+              # v-prefixed baseline tag (e.g., v1.0.1-baseline) -> strip the `v`,
+              # use the bare form. This is a baseline-only release: push ONLY
+              # `:X.Y.Z-baseline` + `:baseline`, never `:X.Y.Z`/`:latest`
+              # (publish.yml explicitly excludes `v*-baseline` so it never fires
+              # for this case, leaving the baseline path exclusive to this workflow).
+              TAG="${REF#v}"
             else
-              # Explicit baseline tag push (e.g., `1.0.1-baseline`) -> use as-is
+              # Bare baseline tag push (e.g., `1.0.1-baseline`) -> use as-is
               TAG="${REF}"
             fi
           else

.github/workflows/publish-nightly.yml

@@ -0,0 +1,136 @@
+name: Publish Nightly
+
+# Builds the disposable `:nightly` and `:nightly-<sha>` tags of
+# `ghcr.io/.../trawl` from `apps/api/Dockerfile` on every push to `main`.
+#
+# Lives separately from publish.yml (release builds on `v*` tags) and
+# publish-baseline.yml (baseline runtime builds on `v*`/`*-baseline` tags)
+# so:
+#   - `v*` tag pushes never trigger a nightly rebuild (release is exclusive)
+#   - main pushes never trigger a release/baseline rebuild
+#   - each workflow has its own GHA cache scope (no cross-pollution)
+#
+# Tag contract:
+#   - push to `main` -> :nightly-<sha> + :nightly
+#   - `:latest` is intentionally NOT touched here — that's owned by
+#     publish.yml and only moves on `v*` release pushes.
+
+on:
+  push:
+    branches: [main]
+
+env:
+  IMAGE: ghcr.io/${{ github.repository_owner }}/trawl
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ${{ env.IMAGE }}
+
+      - name: Sanitize platform name
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+
+      - uses: docker/build-push-action@v6
+        id: build
+        with:
+          context: .
+          file: apps/api/Dockerfile
+          platforms: ${{ matrix.platform }}
+          push: true
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true
+          cache-from: type=gha,scope=trawl-nightly-${{ matrix.platform }}
+          cache-to: type=gha,scope=trawl-nightly-${{ matrix.platform }},mode=max
+          secrets: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: digests-nightly-${{ env.PLATFORM_PAIR }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  merge:
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-nightly-*
+          merge-multiple: true
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            # main branch push → :nightly (disposable test build).
+            type=raw,value=nightly
+            # main branch push → :nightly-<sha> for traceability.
+            type=sha,prefix=nightly-
+
+      - name: Create and push multi-arch manifest
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect manifest
+        run: |
+          # Pull the first tag actually pushed by docker/metadata-action in the
+          # previous step. DOCKER_METADATA_OUTPUT_JSON.tags[] is already
+          # fully-qualified ("ghcr.io/germondai/trawl:nightly-…") so no $IMAGE
+          # prefix needed — the legacy logic re-derived from github.ref /
+          # github.sha which disagreed with what got pushed (type=sha writes
+          # short 7-char SHA but github.sha is the full 40-char hash).
+          tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
+          docker buildx imagetools inspect "$tag"

.github/workflows/publish.yml

@@ -1,9 +1,28 @@
 name: Publish
 
+# Builds `:X.Y.Z` and `:latest` tags of `ghcr.io/.../trawl` from
+# `apps/api/Dockerfile` on `v*` release tag pushes. The `v` prefix is stripped
+# per Docker convention (git tag `v1.0.0` -> docker tag `1.0.0`); `:latest`
+# auto-attaches via the default `latest=auto` flavor of `type=semver`.
+#
+# Lives separately from publish-nightly.yml (main branch pushes) and
+# publish-baseline.yml (baseline runtime pushes). `v*-baseline` is
+# intentionally excluded so a baseline-only release doesn't also push
+# `:X.Y.Z`/`:latest` — publish-baseline.yml owns that path.
+#
+# Tag contract:
+#   - push `v*` -> :X.Y.Z + :latest
+#   - push `v*-baseline` -> nothing here (excluded)
+#   - push `main` -> nothing here (handled by publish-nightly.yml)
+
 on:
   push:
-    branches: [main]
-    tags: ["v*"]
+    tags:
+      # Release tags — pure semver only. `v*-baseline` is intentionally excluded
+      # so a baseline-only release (e.g., `v1.0.0-baseline`) does NOT push `:X.Y.Z`
+      # or `:latest` from this workflow; publish-baseline.yml owns that path.
+      - "v*"
+      - "!v*-baseline"
 
 env:
   IMAGE: ghcr.io/${{ github.repository_owner }}/trawl
@@ -53,8 +72,8 @@ jobs:
           push: true
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true
-          cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
-          cache-to: type=gha,scope=${{ env.PLATFORM_PAIR }},mode=max
+          cache-from: type=gha,scope=trawl-release-${{ matrix.platform }}
+          cache-to: type=gha,scope=trawl-release-${{ matrix.platform }},mode=max
           secrets: |
             GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
 
@@ -66,7 +85,7 @@ jobs:
 
       - uses: actions/upload-artifact@v4
         with:
-          name: digests-${{ env.PLATFORM_PAIR }}
+          name: digests-release-${{ env.PLATFORM_PAIR }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -82,7 +101,7 @@ jobs:
       - uses: actions/download-artifact@v4
         with:
           path: /tmp/digests
-          pattern: digests-*
+          pattern: digests-release-*
           merge-multiple: true
 
       - uses: docker/login-action@v3
@@ -102,11 +121,6 @@ jobs:
             # per Docker convention; type=ref would mirror the v through). type=semver also
             # auto-attaches :latest via the default latest=auto flavor.
             type=semver,pattern={{version}}
-            # main branch push → :nightly (disposable test build).
-            type=raw,value=nightly,enable=${{ github.ref == 'refs/heads/main' }}
-            # main branch push → :nightly-<sha> for traceability. Gated so a vX.Y.Z
-            # tag push does NOT also inherit a nightly-<sha> tag (only main builds are nightly).
-            type=sha,prefix=nightly-,enable=${{ github.ref == 'refs/heads/main' }}
 
       - name: Create and push multi-arch manifest
         working-directory: /tmp/digests
@@ -119,10 +133,7 @@ jobs:
         run: |
           # Pull the first tag actually pushed by docker/metadata-action in the previous
           # step. DOCKER_METADATA_OUTPUT_JSON.tags[] is already fully-qualified
-          # ("ghcr.io/germondai/trawl:nightly-…") so no $IMAGE prefix needed — the legacy
-          # logic re-derived from ${{ github.ref }} / ${{ github.sha }} which disagreed
-          # with what got pushed (type=sha,prefix=nightly- writes short 7-char SHA but
-          # github.sha is the full 40-char hash).
+          # ("ghcr.io/germondai/trawl:1.0.0" / ":latest") so no $IMAGE prefix needed.
           tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
           docker buildx imagetools inspect "$tag"