Summary

• Consolidates the two DockerHub-targeted workflows (docker_build_images_from_develop.yml and docker_build_images_from_tag.yml) into a single build-images.yml that pushes to ghcr.io/os2display/*. Authenticates with the built-in GITHUB_TOKEN — no DockerHub secrets to manage.
• APP_VERSION build-arg is sourced from docker/metadata-action's computed version, so it always matches the image tag (no refs/tags/3.0.0 leakage).
• Adds GHA layer cache (mode=max, scoped per image) so multi-arch builds reuse client_app_builder and api_app_builder stages instead of re-running npm ci + composer install per platform per run.
• Aligns infrastructure/build-n-push.sh with the workflow (single-pass buildx --push, GHCR), and adds a BUILD_LOAD=1 flag for local builds that load into the host docker daemon.
• Folds the post-COPY chmod in infrastructure/nginx/Dockerfile into the COPY itself, eliminating a duplicate-content layer. Nginx image: 135 MB → 108 MB (efficiency 78.7% → 99.5% per dive).
• Expands .dockerignore so editing dev-tooling configs (compose files, Taskfile, phpstan/psalm/rector, Playwright config, IDE state, broader .docker/) no longer invalidates the image build cache.
• Bumps GitHub Actions across all workflows to current major versions (actions/checkout@v6, actions/upload-artifact@v7, go-task/setup-task@v2, all docker/* actions to their current majors).

Resulting trigger semantics

flavor: latest=auto on docker/metadata-action is what makes :latest track non-prerelease semver tags only. RC tags follow normal semver pre-release conventions and are excluded automatically.

Bugs fixed in passing

The two deleted workflows had several issues that the new file does not inherit:

• Tag-push API build was missing platforms:, so production tag images were silently amd64-only.
• Tag workflow passed ${{ github.ref }} (refs/tags/3.0.0) into APP_VERSION. Now uses steps.meta-*.outputs.version (3.0.0).
• Tag workflow used the deprecated echo ::set-output syntax.
• Tag workflow pinned docker/build-push-action@v5 while develop pinned @v6. Now uniform on @v7.
• Neither old workflow supplied build-contexts: repository-root=., which the Dockerfiles' COPY --from=repository-root steps require.

Local validation

• BUILD_LOAD=1 infrastructure/build-n-push.sh produces working API + Nginx images (single-arch native).
• dive --ci on both images: 99.32% (API) and 99.46% (Nginx) efficiency.
• Local --cache-from/--cache-to type=local,mode=max round-trip: cold 41 s → warm 17 s (-59%); after a real PHP source change, 21.5 s with npm ci, npm run build, and the initial composer install --no-scripts all cache-hit.

Test plan

• Merge into the feature branch; confirm the workflow runs on the next push to develop and produces ghcr.io/os2display/display-api-service:develop and …-nginx:develop (multi-arch manifest).
• On a tag push of 3.0.0-RC1 (cut from a release branch), confirm :3.0.0-RC1 is produced and :latest is not updated.
• On a tag push of 3.0.0, confirm :3.0.0 is produced and :latest is updated.
• Second run of any of the above completes substantially faster (cache hits visible in build logs).
• Verify actions/upload-artifact@v7 in playwright.yaml still uploads the report on a Playwright run (no matrix, single artifact name → no immutability conflict expected).

Commits

1. 5402: Bump GitHub Actions to current major versions
2. 5402: Switch image build pipeline to GHCR
3. 5402: Fold chmod into COPY to drop duplicate image layers
4. 5402: Expand .dockerignore for build-cache stability
5. 5402: Make RC builds tag-only and adopt rolling latest tag

🤖 Generated with Claude Code