Restore inline build matrix in production workflow for GAR auth

The bakery-build-native reusable workflow does not support the GCP
workload-identity auth and gcloud Docker config needed to push images
to Google Artifact Registry, so the build job has to stay inline here.
Triggers, concurrency, and the ci meta-job remain aligned with the
images-workbench production workflow; PR validation lives in pr.yml,
so the pull_request trigger is dropped to avoid duplicate builds.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ianpittwood

.github/workflows/production.yml

@@ -42,27 +42,126 @@ jobs:
           result: ${{ steps.alls-green.outcome }}
           slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
 
+  matrix:
+    name: Image Matrix
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      matrix: ${{ steps.images.outputs.matrix }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Install
+        uses: "posit-dev/images-shared/setup-bakery@main"
+
+      - name: Images
+        id: images
+        env:
+          DEV_VERSIONS: "exclude"
+          MATRIX_VERSIONS: "exclude"
+        run: |
+          echo "matrix=$(bakery ci matrix --quiet --dev-versions "$DEV_VERSIONS" --matrix-versions "$MATRIX_VERSIONS" | jq --compact-output .)" >> $GITHUB_OUTPUT
+
   build:
-    name: Build
-    # Build all images, excluding dev versions.
-    #
-    # Builds all versions of each image in parallel.
-    #
-    # Run on merges to main, or on weekly scheduled re-builds.
+    name: "${{ matrix.img.image }}:${{ matrix.img.version }}"
     permissions:
       contents: read
       packages: write
+      id-token: write
+    needs: matrix
+    runs-on: ubuntu-latest-4x
+    strategy:
+      fail-fast: false
+      matrix:
+        img: ${{ fromJson(needs.matrix.outputs.matrix) }}
 
-    uses: "posit-dev/images-shared/.github/workflows/bakery-build-native.yml@main"
-    secrets:
-      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-      DOCKER_HUB_README_USERNAME: ${{ secrets.DOCKER_HUB_README_USERNAME }}
-      DOCKER_HUB_README_PASSWORD: ${{ secrets.DOCKER_HUB_README_PASSWORD }}
-    with:
-      dev-versions: "exclude"
-      matrix-versions: "exclude"
-      # Push images only for merges into main and weekly schduled re-builds.
-      push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - name: Setup bakery
+        uses: "posit-dev/images-shared/setup-bakery@main"
+
+      - name: Setup goss
+        uses: "posit-dev/images-shared/setup-goss@main"
+
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Authenticate to GCP
+        id: gcp-auth
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' }}
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093  # v3.0.0
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+
+      - name: Configure Docker for GCP Artifact Registry
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' }}
+        run: |
+          gcloud auth configure-docker us-central1-docker.pkg.dev,us-docker.pkg.dev,europe-docker.pkg.dev,asia-docker.pkg.dev --quiet
+
+      - name: Setup docker buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
+
+      - name: Build
+        env:
+          GIT_SHA: ${{ github.sha }}
+          IMAGE_NAME: ${{ matrix.img.image }}
+          IMAGE_VERSION: ${{ matrix.img.version }}
+          DEV_VERSIONS: "exclude"
+          MATRIX_VERSIONS: "exclude"
+          REGISTRY: ghcr.io/${{ github.repository_owner }}
+        run: |
+          bakery build --load --pull \
+            --retry 1 \
+            --image-name "^${IMAGE_NAME}$" \
+            --image-version "$IMAGE_VERSION" \
+            --dev-versions "$DEV_VERSIONS" \
+            --matrix-versions "$MATRIX_VERSIONS" \
+            --cache-registry "$REGISTRY"
+
+      - name: Test
+        env:
+          IMAGE_NAME: ${{ matrix.img.image }}
+          IMAGE_VERSION: ${{ matrix.img.version }}
+          DEV_VERSIONS: "exclude"
+          MATRIX_VERSIONS: "exclude"
+        run: |
+          GOSS_PATH=${GITHUB_WORKSPACE}/tools/goss \
+          DGOSS_PATH=${GITHUB_WORKSPACE}/tools/dgoss \
+          bakery run dgoss \
+            --image-name "^${IMAGE_NAME}$" \
+            --image-version "$IMAGE_VERSION" \
+            --dev-versions "$DEV_VERSIONS" \
+            --matrix-versions "$MATRIX_VERSIONS"
+
+      - name: Push
+        # Push images only for merges into main and weekly scheduled re-builds.
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' }}
+        env:
+          GIT_SHA: ${{ github.sha }}
+          IMAGE_NAME: ${{ matrix.img.image }}
+          IMAGE_VERSION: ${{ matrix.img.version }}
+          DEV_VERSIONS: "exclude"
+          MATRIX_VERSIONS: "exclude"
+        run: |
+          bakery build --push --pull \
+            --retry 1 \
+            --image-name "^${IMAGE_NAME}$" \
+            --image-version "$IMAGE_VERSION" \
+            --dev-versions "$DEV_VERSIONS" \
+            --matrix-versions "$MATRIX_VERSIONS"
 
   clean:
     name: Clean