ci: publish pilot images to 508-dev GHCR

[michaelmwu]

Summary

• replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
• validate five pilot images on pull requests without publishing or package-write permission
• publish immutable commit tags plus main from the default branch only
• attach provenance and SBOM attestations to each published image

Security boundary

• the workflow-level token has no permissions
• PR jobs receive only contents: read
• only the protected-main publish job receives packages: write
• checkout credentials are not persisted

Validation

• actionlint .github/workflows/publish-images.yml
• git diff --check

Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.

---

Note

Medium Risk
Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.

Overview
Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).

Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.

Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.

^{Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)

[coderabbitai]

Warning

Review limit reached

Next included review available in 31 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2

📥 Commits

Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.

📒 Files selected for processing (1)

• .github/workflows/publish-images.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8b722549b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)