Switch GHCR workflow to nerdctl

Replace docker/buildx with nerdctl for container builds

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.github/workflows/ghcr-publish.yml

@@ -32,42 +32,39 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
+      - name: Install nerdctl and containerd
+        run: |
+          # Install containerd
+          sudo apt-get update
+          sudo apt-get install -y containerd
+          sudo systemctl start containerd
+
+          # Install nerdctl
+          NERDCTL_VERSION=2.0.2
+          curl -sSL "https://github.com/containerd/nerdctl/releases/download/v${NERDCTL_VERSION}/nerdctl-${NERDCTL_VERSION}-linux-amd64.tar.gz" | sudo tar -xz -C /usr/local/bin
+
+          # Install CNI plugins
+          CNI_VERSION=1.6.1
+          sudo mkdir -p /opt/cni/bin
+          curl -sSL "https://github.com/containernetworking/plugins/releases/download/v${CNI_VERSION}/cni-plugins-linux-amd64-v${CNI_VERSION}.tgz" | sudo tar -xz -C /opt/cni/bin
 
       - name: Log in to GHCR
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | sudo nerdctl login ghcr.io -u ${{ github.actor }} --password-stdin
 
-      - name: Extract metadata
-        id: meta
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=ref,event=branch
-            type=sha
+      - name: Build image
+        run: |
+          sudo nerdctl build --target ${{ matrix.target.dockerfile-target }} -t ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:${{ github.sha }} .
+          sudo nerdctl tag ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:${{ github.sha }} ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:latest
 
-      - name: Build and push
-        id: push
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
-        with:
-          context: .
-          target: ${{ matrix.target.dockerfile-target }}
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Push image
+        run: |
+          sudo nerdctl push ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:${{ github.sha }}
+          sudo nerdctl push ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:latest
 
-      - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v2
-        with:
-          subject-name: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}
-          subject-digest: ${{ steps.push.outputs.digest }}
-          push-to-registry: true
+      - name: Tag release version
+        if: github.event_name == 'release'
+        run: |
+          VERSION=${{ github.event.release.tag_name }}
+          sudo nerdctl tag ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:${{ github.sha }} ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:${VERSION}
+          sudo nerdctl push ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.target.name }}:${VERSION}