publish after all builds

Author: opajonk

.github/workflows/ci.yaml

@@ -12,12 +12,8 @@ concurrency:
 
 jobs:
   build-x86_64:
-    name: 'Check, Build, Test, Publish DevContainer (x86_64)'
+    name: 'DevContainer (x86_64)'
     runs-on: ubuntu-24.04
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
 
     steps:
       - name: Checkout (GitHub)
@@ -31,7 +27,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Use .devcontainer from THIS repo for building and testing
-      - name: Check, Build, Test, Publish
+      - name: Check, Build, Test
         uses: devcontainers/ci@v0.3
         with:
           # The .devcontainer is never published as pre-built container.
@@ -52,22 +48,9 @@ jobs:
             # Test
             ./scripts/test.sh
 
-            # Optionally: Publish
-            # We do not use the push feature of devcontainers/ci here, since that would push the wrong container.
-            # Instead, we use the publish script which pushes the correct container (residing in src/s-core-devcontainer).
-            if [ "${{ github.ref }}" = "refs/heads/main" ]; then
-              # manually login to ghcr.io for publishing
-              echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-              ./scripts/publish.sh "main"
-            fi
-
   build-arm64:
-    name: 'Check, Build, Test, Publish DevContainer (arm64)'
+    name: 'DevContainer (arm64)'
     runs-on: ubuntu-24.04-arm
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
 
     steps:
       - name: Checkout (GitHub)
@@ -81,7 +64,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # Use .devcontainer from THIS repo for building and testing
-      - name: Check, Build, Test, Publish
+      - name: Check, Build, Test
         uses: devcontainers/ci@v0.3
         with:
           # The .devcontainer is never published as pre-built container.
@@ -102,6 +85,34 @@ jobs:
             # Test
             ./scripts/test.sh
 
+  publish:
+    needs: [build-arm64, build-x86_64]
+    name: 'Publish'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    steps:
+      - name: Checkout (GitHub)
+        uses: actions/checkout@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish
+        uses: devcontainers/ci@v0.3
+        with:
+          # The .devcontainer is never published as pre-built container.
+          # We want to only use it for building and testing the actual container, which resides in src/s-core-devcontainer.
+          push: "never"
+          runCmd: |
+            set -eux pipefail
+
             # Optionally: Publish
             # We do not use the push feature of devcontainers/ci here, since that would push the wrong container.
             # Instead, we use the publish script which pushes the correct container (residing in src/s-core-devcontainer).

scripts/publish-arm.sh

@@ -12,29 +12,7 @@ for LABEL in "$@"; do
 done
 
 # Define target architectures
-ARCHITECTURES=("amd64")
-
-# Build and push for each architecture, creating all requested tags
-for ARCH in "${ARCHITECTURES[@]}"; do
-    echo "Building all tags (${LABELS[@]}) for architecture: ${ARCH}"
-
-    # Prepare image names with tags (each tag includes a label and an architecture)
-    IMAGES=()
-    for LABEL in "${LABELS[@]}"; do
-        IMAGES+=("--image-name \"ghcr.io/eclipse-score/devcontainer:${LABEL}-${ARCH}\"")
-    done
-
-    # Prepare devcontainer build command
-    DEVCONTAINER_CALL="devcontainer build --push --workspace-folder src/s-core-devcontainer --cache-from ghcr.io/eclipse-score/devcontainer"
-
-    # Append image names to the build command
-    for IMAGE in "${IMAGES[@]}"; do
-        DEVCONTAINER_CALL+=" $IMAGE"
-    done
-
-    # Execute the build and push all tags for the specific architecture
-    eval "$DEVCONTAINER_CALL --platform linux/${ARCH}"
-done
+ARCHITECTURES=("amd64", "arm64")
 
 # Create and push the merged multiarch manifest for each tag; each tag combines all architecture-specific tags into one tag
 for LABEL in "${LABELS[@]}"; do