fix: Add back temporary workflow to publish main to ghcr

[brendan-kellam]

This PR adds back a workflow to publish main to ghcr since the previous PR removed that functionality.

---

Note

Introduces reusable CI for building and publishing multi-architecture Docker images and wires them into dev and prod releases.

• New reusable workflows: ._github/workflows/_build.yml (per-platform build, sign, and digest artifact upload) and ._github/workflows/_merge.yml (merge digests into multi-platform manifest and push)
• New release-dev.yml: builds from main and publishes ghcr.io/sourcebot-dev/sourcebot:main
• Refactors release-prod.yml: replaces inline build/manifest steps with calls to _build.yml and _merge.yml, adds publish-to-registry job post-tagging, and updates job dependencies/cleanup; preserves tagging (vX.Y.Z, latest) and GitHub Release creation

^{Written by Cursor Bugbot for commit 2eae6c3. This will update automatically on new commits. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

@brendan-kellam your pull request is missing a changelog!

[cursor]

This is the final PR Bugbot will review for you during this billing cycle

Your free Bugbot reviews will reset on February 14

Details

You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Missing concurrency control allows race condition on parallel pushes

Medium Severity

The workflow lacks a concurrency block that the release workflow includes. When multiple pushes to main occur in quick succession, parallel workflow runs can race to publish images. If an older commit's workflow completes after a newer commit's workflow, the main tag will point to stale code. This could cause users pulling ghcr.io/sourcebot-dev/sourcebot:main to receive an outdated image version.

 

[brendan-kellam]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[cursor]

Missing permissions for Docker registry push operations

High Severity

The workflow-level permissions: contents: read setting restricts all unspecified permissions to none. The build and publish-to-registry jobs call reusable workflows (_build.yml and _merge.yml) that require packages: write and id-token: write, but these jobs don't specify job-level permissions to grant those scopes. The called workflows' permission requests are limited by what the caller provides, so the Docker image push and cosign signing operations will fail due to insufficient GITHUB_TOKEN permissions. The original inline build job had these permissions explicitly specified at the job level.

Additional Locations (1)

• .github/workflows/release-prod.yml#L2-L4