refactor: remove GHCR from docker workflow, use DockerHub only

- Removed all GHCR references (login, push, intermediate tags, cleanup)
- Build and publish use DockerHub directly for intermediate and final images
- Removed packages:write permission from release workflow (no longer needed)
- Trivy scans DockerHub image

Author: ytallo

.github/workflows/docker-engine.yml

@@ -4,13 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: 'Release tag to build from (e.g., v1.2.3)'
+        description: 'Release tag to build from (e.g., iii/v1.2.3)'
         required: true
         type: string
   workflow_call:
     inputs:
       release_tag:
-        description: 'Release tag to build from (e.g., v1.2.3)'
+        description: 'Release tag to build from (e.g., iii/v1.2.3)'
         required: true
         type: string
     secrets:
@@ -21,11 +21,9 @@ on:
 
 permissions:
   contents: read
-  packages: write
   security-events: write
 
 env:
-  GHCR_REPO: ghcr.io/${{ github.repository_owner }}/iii
   DOCKERHUB_REPO: iiidev/iii
 
 jobs:
@@ -82,26 +80,25 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to GHCR
+      - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.GHCR_REPO }}
+          images: ${{ env.DOCKERHUB_REPO }}
 
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: engine
           platforms: ${{ matrix.platform }}
           push: true
-          tags: ${{ env.GHCR_REPO }}:build-${{ matrix.docker_arch }}
+          tags: ${{ env.DOCKERHUB_REPO }}:build-${{ matrix.docker_arch }}
           labels: ${{ steps.meta.outputs.labels }}
           provenance: false
 
@@ -117,51 +114,31 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: |
-            ${{ env.GHCR_REPO }}
-            ${{ env.DOCKERHUB_REPO }}
+          images: ${{ env.DOCKERHUB_REPO }}
           tags: |
             type=raw,value=${{ needs.setup.outputs.version }}
             type=raw,value=latest
 
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Login to DockerHub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
-        continue-on-error: true
 
-      - name: Create and push multi-platform manifest (GHCR)
-        run: |
-          for tag in "${{ needs.setup.outputs.version }}" "latest"; do
-            docker buildx imagetools create \
-              -t "${{ env.GHCR_REPO }}:$tag" \
-              "${{ env.GHCR_REPO }}:build-amd64" \
-              "${{ env.GHCR_REPO }}:build-arm64"
-          done
-
-      - name: Create and push multi-platform manifest (DockerHub)
-        continue-on-error: true
+      - name: Create and push multi-platform manifest
         run: |
           for tag in "${{ needs.setup.outputs.version }}" "latest"; do
             docker buildx imagetools create \
               -t "${{ env.DOCKERHUB_REPO }}:$tag" \
-              "${{ env.GHCR_REPO }}:build-amd64" \
-              "${{ env.GHCR_REPO }}:build-arm64"
+              "${{ env.DOCKERHUB_REPO }}:build-amd64" \
+              "${{ env.DOCKERHUB_REPO }}:build-arm64"
           done
 
       - name: Run Trivy vulnerability scanner
         continue-on-error: true
         uses: aquasecurity/trivy-action@0.28.0
         with:
-          image-ref: ${{ env.GHCR_REPO }}:${{ needs.setup.outputs.version }}
+          image-ref: ${{ env.DOCKERHUB_REPO }}:${{ needs.setup.outputs.version }}
           format: 'sarif'
           output: 'trivy-results.sarif'
           severity: 'CRITICAL,HIGH'
@@ -177,32 +154,13 @@ jobs:
         continue-on-error: true
         uses: aquasecurity/trivy-action@0.28.0
         with:
-          image-ref: ${{ env.GHCR_REPO }}:${{ needs.setup.outputs.version }}
+          image-ref: ${{ env.DOCKERHUB_REPO }}:${{ needs.setup.outputs.version }}
           format: 'table'
           severity: 'CRITICAL'
           exit-code: '1'
           ignore-unfixed: true
 
-      - name: Remove intermediate build tags (GHCR)
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          OWNER: ${{ github.repository_owner }}
-        run: |
-          PKG_NAME=$(basename "${{ env.GHCR_REPO }}")
-          for arch in amd64 arm64; do
-            tag="build-${arch}"
-            version_id=$(gh api "/orgs/${OWNER}/packages/container/${PKG_NAME}/versions" \
-              --jq ".[] | select(.metadata.container.tags[] == \"${tag}\") | .id" 2>/dev/null \
-              || gh api "/users/${OWNER}/packages/container/${PKG_NAME}/versions" \
-              --jq ".[] | select(.metadata.container.tags[] == \"${tag}\") | .id" 2>/dev/null || true)
-            if [ -n "$version_id" ]; then
-              gh api --method DELETE "/orgs/${OWNER}/packages/container/${PKG_NAME}/versions/${version_id}" 2>/dev/null \
-                || gh api --method DELETE "/users/${OWNER}/packages/container/${PKG_NAME}/versions/${version_id}" 2>/dev/null || true
-            fi
-          done
-
-      - name: Remove intermediate build tags (DockerHub)
+      - name: Remove intermediate build tags
         continue-on-error: true
         env:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -233,7 +191,6 @@ jobs:
 
           | Registry | Repository |
           |----------|------------|
-          | GHCR | `${{ env.GHCR_REPO }}` |
           | DockerHub | `${{ env.DOCKERHUB_REPO }}` |
 
           **Platforms:** linux/amd64, linux/arm64 (pre-built binaries)
@@ -255,7 +212,7 @@ jobs:
                   "type": "section",
                   "text": {
                     "type": "mrkdwn",
-                    "text": "*Docker Image Published*\n\nVersion: `${{ needs.setup.outputs.version }}`\nPlatforms: `linux/amd64`, `linux/arm64`\nRuntime: Distroless (nonroot)\n\n*Images:*\n\u2022 `${{ env.DOCKERHUB_REPO }}:${{ needs.setup.outputs.version }}`\n\u2022 `${{ env.GHCR_REPO }}:${{ needs.setup.outputs.version }}`"
+                    "text": "*Docker Image Published*\n\nVersion: `${{ needs.setup.outputs.version }}`\nPlatforms: `linux/amd64`, `linux/arm64`\nRuntime: Distroless (nonroot)\n\n*Image:*\n\u2022 `${{ env.DOCKERHUB_REPO }}:${{ needs.setup.outputs.version }}`"
                   }
                 },
                 {

.github/workflows/release-iii.yml

@@ -9,7 +9,6 @@ permissions:
   contents: write
   id-token: write
   actions: write
-  packages: write
   security-events: write
 
 concurrency: