* feat(ci): publish omnigraph-server image to Docker Hub alongside GHCR
Docker Hub (docker.io/modernrelay/omnigraph-server) becomes the primary
anonymous-pull distribution channel; the step no-ops when the
DOCKERHUB_* secrets are unset so forks and the GHCR-only path keep
working. Same latest-tag policy as GHCR (real tag pushes only, never
dispatch backfills). Docs updated in the same PR (ci.md, deployment.md).
* review fixes: preserve digest summary on Hub failure, tolerate unprefixed RepoDigests
- Docker Hub push is continue-on-error with an explicit fail-gate AFTER
the digest report, so a Hub failure still fails the run but can no
longer suppress the summary for the already-pushed GHCR image.
- RepoDigests may store Hub images without the docker.io/ prefix
depending on Docker version; the digest grep now accepts both forms.
* feat(ci): publish omnigraph-server container image to GHCR on release
Build binaries inside a rust:1-bookworm container (matching the
Dockerfile's bookworm-slim runtime glibc) with the aws feature enabled,
then build and push ghcr.io/<owner>/omnigraph-server:<tag>. Separate
from release.yml so an image failure never blocks the binary release,
and a workflow_dispatch backfill of a past tag never re-runs the release
matrix or repoints :latest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* review fixes: validate dispatch tag (existing v* only), document workflow + GHCR image
- Guard workflow_dispatch: the free-form tag input must name an EXISTING
v* tag (gh api ref check) and checkout is pinned to refs/tags/<tag>,
so a branch/SHA can never be published under a release-looking image
tag (greptile P1).
- docs/dev/ci.md: add the publish-image.yml entry (same-PR docs rule).
- docs/user/deployment.md: document pulling the prebuilt GHCR image.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
