ci: push test image tagged pr-<id> on pull requests

Author: tembleking

.github/workflows/test_image.yaml

@@ -17,8 +17,12 @@ jobs:
   test_build:
     name: Test Build (${{ matrix.arch }})
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: nix develop --command bash {0}
     permissions:
       contents: read # required for actions/checkout
+      packages: write # required for pushing to GHCR
     strategy:
       max-parallel: 1
       matrix:
@@ -67,3 +71,66 @@ jobs:
           sysdig-secure-url: ${{ secrets.SECURE_ENV_MON_ENDPOINT }}
           stop-on-failed-policy-eval: true
           stop-on-processing-error: true
+
+      - name: Log in to GitHub Container Registry
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | skopeo login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Push image by digest
+        env:
+          REGISTRY: ghcr.io/sysdiglabs/sysdig-mcp-server
+        run: |
+          skopeo copy --digestfile /tmp/digest \
+            docker-archive:result \
+            docker://$REGISTRY --format oci
+
+          mkdir -p /tmp/digests
+          cp /tmp/digest /tmp/digests/${{ matrix.arch }}
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v5
+        with:
+          name: digests-${{ matrix.arch }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  push_pr_image:
+    name: Push PR image to GitHub Packages
+    runs-on: ubuntu-latest
+    needs: [test_build]
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      packages: write
+    env:
+      REGISTRY: ghcr.io/sysdiglabs/sysdig-mcp-server
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v6
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create manifest list and push
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create --tag $REGISTRY:pr-${PR_NUMBER} \
+            $(printf "$REGISTRY@%s " $(cat *))
+
+      - name: Inspect image
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: docker buildx imagetools inspect $REGISTRY:pr-${PR_NUMBER}