ci: build core images on native runners

[eitsupi]

Close #901
Related to #1015

Created by Codex gpt-5.6-sol

[Copilot]

Pull request overview

Moves core image publishing to native architecture runners with digest-based multi-registry manifests.

Changes:

• Adds reusable per-target native build and publication workflow.
• Adds digest validation, manifest finalization, and smoke testing.
• Documents and tests the new publishing flow.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/core.yml	Orchestrates target builds and smoke tests.
.github/workflows/core-target.yml	Builds platforms and publishes manifests.
.github/workflows/bakefile-test.yml	Expands CI test triggers.
build/scripts/core-publish.sh	Implements publication and verification.
build/scripts/test-core-publish.sh	Tests publication metadata handling.
build/scripts/test-core-workflow.sh	Validates workflow/Bake alignment.
Makefile	Adds new test targets.
build/README.md	Documents core publishing.
bakefiles/README.md	Clarifies Bake file responsibilities.

Suppressed comments (1)

.github/workflows/core-target.yml:78

• Each repeated output= override replaces the previous Bake value, so the GHCR line wins and the canonical digest is never pushed to Docker Hub. write-metadata nevertheless records that digest for both registries, causing finalize to fail when it inspects docker.io/...@digest. Append the second exporter instead of replacing the first.

            ${{ inputs.target }}.output=type=image,name=${{ steps.config.outputs.docker_repository }},push-by-digest=true,name-canonical=true,push=true
            ${{ inputs.target }}.output=type=image,name=${{ steps.config.outputs.ghcr_repository }},push-by-digest=true,name-canonical=true,push=true

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/core.yml:23

• cancel-in-progress: false protects only the running workflow; without queue: max, GitHub keeps only one pending run and cancels that pending run when a third run joins this group. Because push, release, and manual publishers all share this group, an all-version release publish can be dropped behind a later latest-only run. Add queue: max and update the concurrency assertion in test-core-workflow.sh so publisher runs are actually queued rather than replaced.

  group: core-publish
  cancel-in-progress: false

build/scripts/test-core-workflow.sh:32

• This alternation accepts needs: prepare for every target, so the test still passes if any post-r-ver job loses its dependency on the preceding target. Compute the one expected needs value for each iteration and compare it exactly so the serialization regression this test is intended to catch cannot slip through.

    grep -Eq "needs: (prepare|\[prepare, ${previous}\])$" <<<"${block}" || {

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.