Fix auto-publish: invoke publish workflows directly from tag.yml (#37)

After a protocol bump the tag was created but the image was never published.
Root cause: tag.yml pushes the tag with the default GITHUB_TOKEN, and a tag
pushed by GITHUB_TOKEN does not emit a `push: tags` event (GitHub's
recursion-prevention), so dockerhub.yml / ghcr.yml never triggered.

Fix: convert dockerhub.yml and ghcr.yml into reusable workflows
(`on: workflow_call`) and have tag.yml call them via `jobs.<id>.uses` in the
same run that creates the tag. No tag event is relied upon, so the
GITHUB_TOKEN rule is irrelevant. The `push: tags` trigger is kept on both
publish workflows as a manual safety-net (a real user pushing a tag still
publishes).

Also:
- drop the broken `rhosys/github-action-rebuild-pull-requests` step (404s,
  reddened every run, unrelated to tagging)
- bump actions/checkout v2->v4, docker/* actions to current major versions
- ghcr: derive the image tag from the version input instead of the git ref
  (metadata-action keyed off the ref, which is `master` on the workflow_call
  path)

Co-authored-by: Wizard1209 <wizard1209@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

.github/workflows/dockerhub.yml

@@ -1,6 +1,13 @@
 name: Publish on Docker Hub
 
 on:
+  # Called by tag.yml right after the tag is created (the reliable path).
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+  # Safety-net: a tag pushed manually by a real user still publishes.
   push:
     tags:
       - "v*"
@@ -9,34 +16,31 @@ jobs:
   build:
     name: Docker images for Docker Hub
     runs-on: ubuntu-latest
+    # workflow_call -> inputs.version ; manual tag push -> the tag name.
+    env:
+      VERSION: ${{ inputs.version || github.ref_name }}
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
-      - name: Set env
-        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-  
       - name: Log in to Docker Hub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-        
+
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v1
-        with:
-          install: true
+        uses: docker/setup-buildx-action@v3
 
       - name: Build and push image
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
           push: true
-          build-args: TAG=${{ env.RELEASE_VERSION }}
-          tags: bakingbad/sandboxed-node:${{ env.RELEASE_VERSION }}
+          build-args: TAG=${{ env.VERSION }}
+          tags: bakingbad/sandboxed-node:${{ env.VERSION }}
           platforms: linux/amd64,linux/arm64

.github/workflows/ghcr.yml

@@ -1,6 +1,13 @@
 name: Publish on GHCR
 
 on:
+  # Called by tag.yml right after the tag is created (the reliable path).
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+  # Safety-net: a tag pushed manually by a real user still publishes.
   push:
     tags:
       - 'v*'
@@ -9,45 +16,39 @@ jobs:
   build:
     name: Docker images for ghcr.io
     runs-on: ubuntu-latest
+    # When called by tag.yml the GITHUB_TOKEN scope is granted by the caller job;
+    # restated here so the manual `push: tags` path also gets packages:write.
+    permissions:
+      contents: read
+      packages: write
+    # workflow_call -> inputs.version ; manual tag push -> the tag name.
     env:
-      ACTIONS_ALLOW_UNSECURE_COMMANDS: true
-      DOCKER_REGISTRY: ghcr.io
-      DOCKER_IMAGE_BASE: ${{ github.repository }}
+      VERSION: ${{ inputs.version || github.ref_name }}
     steps:
-      - name: Set tag
-        run: echo "TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
-
       - name: Check out the repo
-        uses: actions/checkout@v2
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: actions/checkout@v4
 
       - name: Log in to the registry
-        uses: docker/login-action@v1
+        uses: docker/login-action@v3
         with:
-          registry: ${{ env.DOCKER_REGISTRY }}
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Image tags & labels
-        id: meta
-        uses: docker/metadata-action@v3
-        with:
-          images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_BASE }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      - name: Image build & push
-        uses: docker/build-push-action@v2
+      - name: Build and push image
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: Dockerfile
           push: true
+          build-args: TAG=${{ env.VERSION }}
+          tags: ghcr.io/${{ github.repository }}:${{ env.VERSION }}
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-          build-args: TAG=${{ env.TAG }}

.github/workflows/tag.yml

@@ -1,26 +1,51 @@
 name: Tag the current Octez release
 
-
 on:
   push:
     branches:
       - 'master'
 
+# contents:write lets the tag job push the tag.
+# The publish workflows are invoked directly (jobs.<id>.uses) in this same run, so we
+# do NOT rely on the tag-push emitting a `push: tags` event — a tag pushed by
+# GITHUB_TOKEN never emits one (GitHub's recursion-prevention), which is exactly the
+# bug that left the image unpublished after every protocol bump.
 permissions:
   contents: write
-  actions: write
 
 jobs:
-  build:
-    name: Force push tag of the current Octez release
+  tag:
+    name: Tag the current Octez release
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.release.outputs.version }}
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: make release
-        run: make release
+        id: release
+        run: |
+          make release
+          echo "version=$(cat octez_version)" >> "$GITHUB_OUTPUT"
 
-      - uses: rhosys/github-action-rebuild-pull-requests@v1.0
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+  dockerhub:
+    name: Publish on Docker Hub
+    needs: tag
+    uses: ./.github/workflows/dockerhub.yml
+    with:
+      version: ${{ needs.tag.outputs.version }}
+    secrets: inherit
+
+  ghcr:
+    name: Publish on GHCR
+    needs: tag
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/ghcr.yml
+    with:
+      version: ${{ needs.tag.outputs.version }}
+    secrets: inherit