Publish the Electric image to electricsql/electric-temp and stop using artifacts for digests

[KyleAMathews]

CI cannot publish the Electric sync service image to electricsql/electric on Docker Hub now. This PR publishes the image to a temporary Docker Hub repository, electricsql/electric-temp, until Docker repairs the original repositories. It also removes a dependency on Actions artifact storage that blocked all image publishing.

Why publishing stopped

Two separate problems stopped image publishing.

Broken Docker Hub repositories. The old CI credentials belonged to a Docker Hub account that someone removed. After the removal, the electricsql/* and electricax/* repositories stay in a broken state:

• GET /v2/repositories/electricsql/electric/ returns 404, also with org credentials.
• The registry refuses pulls of electricsql/electric:latest, also for anonymous users.
• The tag API still lists 185 tags for electricsql/electric.
• Docker Hub does not let us create the repositories again, because the names "already exist".

Docker support told us that their engineering team must repair the repositories. They did not give a date.

Full artifact storage. The shared workflow docker_multiarch_image.yml builds each platform in a separate job. Each job uploaded its image digest as an Actions artifact for the manifest job. The org artifact storage quota is full, so the upload failed with Artifact storage quota has been hit. This failure occurs for all registries.

What changes

Digests go through job outputs. Each platform job now writes its digest to a job output named digest_<platform_id>. Each matrix leg sets a different output name, so the legs do not overwrite each other. The manifest job writes the outputs to /tmp/digests, and the manifest script stays the same. If the number of digests is not equal to the number of platforms, the manifest job stops with an error. A new platform_id needs a new output in build_and_push_image. This PR also removes the unused artifact_prefix input.

The sync service image goes to electricsql/electric-temp.

Build	Before	Now
Release	electricsql/electric:latest, :<version>	electricsql/electric-temp:latest, :<version>
Canary (push to main)	electricsql/electric:canary, electricsql/electric-canary:latest, :<sha>	electricsql/electric-temp:canary

Canary builds push only :canary. Thus a canary build cannot overwrite the release :latest tag in the shared temporary repository.

The agents-server and Durable Streams Rust server workflows do not change. Their electricax repositories are also broken, and the current token covers only the electricsql organization.

How to go back to electricsql/electric

The original repository names stay in sync_service_dockerhub_image.yml as comments with the prefix # Docker Hub:. When Docker repairs the repositories, uncomment those lines and remove the electric-temp lines. The job-output change stays.

Earlier commits in this branch

The first commit sent the images to the GitHub Container Registry (GHCR). A later commit reverts it, because GHCR also needs org storage and the free storage is too small. The net diff has no GHCR changes.

Known limits

• The docs, compose files, and skills still refer to electricsql/electric. This PR does not change them.
• The DOCKERHUB_TOKEN secret now holds an electricsql organization access token with push scope on electricsql/*.

Verification

• Run 37134261454 built @core/sync-service@1.8.1 from this branch. All jobs passed.
• An anonymous registry request returns multi-arch manifests for electricsql/electric-temp:latest and :1.8.1, with amd64 and arm64.
• A local run of the new digest step with sample data wrote both digest files. With one digest missing, the step stopped with exit code 1.

🤖 Generated with Claude Code