feat(publish): rebuild releases nightly and let stable follow the tested one

Every image build now carries <version> and the immutable
<version>.<unix-ts>; latest goes to the newest release on main, each
prefix (2, 2.3) to the newest release starting with it, and stable to the
release the git tag stable marks, which "Mark stable commit" sets only
after all tests passed.

publish-containers.yml runs daily at 03:00 UTC and on workflow_dispatch.
A rebuild publishes the newest release and, when the git tag stable sits
on an older one, that release too, so both get base-image security
updates. compute-publish-container-info.sh emits the release list with
each release's moving tags; image.sh takes them as --aliases instead of
--stable.

A platform build whose installed package set equals the published
<version> pushes nothing, and a merge whose image index equals the
published one only moves the tags not yet on it, without a new stamp.
Only vX.Y.Z tags count as releases; v2.4.0-rc1 no longer moves 2 or 2.4.

The build scripts come from the release commit: releases tagged before
this change keep the old scripts until a newer release replaces them.

tests/integration: 22 tests for release choice, aliases, the stable
rebuild, the push skip and the triggers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/publish-containers.yml

@@ -4,19 +4,20 @@ on:
   workflow_run:
     workflows: ["Mark stable commit"]
     types: [completed]
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
 
 jobs:
   prepare:
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
 
     permissions:
       contents: read
 
     outputs:
-      should_publish: ${{ steps.info.outputs.should_publish }}
-      version: ${{ steps.info.outputs.version }}
-      is_stable: ${{ steps.info.outputs.is_stable }}
+      releases: ${{ steps.info.outputs.releases }}
 
     steps:
       - name: Checkout repository (with tags)
@@ -24,25 +25,16 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Checkout workflow_run commit and refresh tags
+      - name: Resolve the releases this run publishes
+        id: info
         env:
           WORKFLOW_RUN_SHA: ${{ github.event.workflow_run.head_sha }}
-        run: bash scripts/github/publish-containers/checkout-workflow-run-commit.sh
-
-      - name: Check whether tagged commit is on main
-        id: branch-check
-        env:
-          TARGET_SHA: ${{ github.event.workflow_run.head_sha }}
-        run: bash scripts/github/common/check-tagged-commit-on-main.sh
-
-      - name: Compute version and stable flag
-        id: info
-        if: steps.branch-check.outputs.is_on_main == 'true'
         run: bash scripts/github/publish-containers/compute-publish-container-info.sh
 
   build:
     needs: prepare
-    if: ${{ needs.prepare.outputs.should_publish == 'true' }}
+    if: ${{ needs.prepare.result == 'success' && needs.prepare.outputs.releases != '[]' }}
+    name: Build ${{ matrix.distro }} ${{ matrix.release.version }} for ${{ matrix.target.platform }}
     runs-on: ${{ matrix.target.runner }}
 
     permissions:
@@ -58,12 +50,13 @@ jobs:
             runner: ubuntu-latest
           - platform: linux/arm64
             runner: ubuntu-24.04-arm
+        release: ${{ fromJSON(needs.prepare.outputs.releases) }}
 
     steps:
-      - name: Checkout workflow_run commit
+      - name: Checkout ${{ matrix.release.version }}
         uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ matrix.release.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003
@@ -77,17 +70,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push ${{ matrix.distro }} for ${{ matrix.target.platform }}
+      - name: Build and push ${{ matrix.distro }} ${{ matrix.release.version }} for ${{ matrix.target.platform }}
         env:
           OWNER: ${{ github.repository_owner }}
-          VERSION: ${{ needs.prepare.outputs.version }}
+          VERSION: ${{ matrix.release.version }}
           PKGMGR_DISTRO: ${{ matrix.distro }}
           PLATFORM: ${{ matrix.target.platform }}
         run: bash scripts/github/publish-containers/publish-container-images.sh
 
   merge:
     needs: [prepare, build]
-    if: ${{ !cancelled() && needs.prepare.outputs.should_publish == 'true' }}
+    if: ${{ !cancelled() && needs.prepare.result == 'success' && needs.prepare.outputs.releases != '[]' }}
+    name: Merge ${{ matrix.distro }} ${{ matrix.release.version }}
     runs-on: ubuntu-latest
 
     permissions:
@@ -98,12 +92,13 @@ jobs:
       fail-fast: false
       matrix:
         distro: *distros
+        release: ${{ fromJSON(needs.prepare.outputs.releases) }}
 
     steps:
-      - name: Checkout workflow_run commit
+      - name: Checkout ${{ matrix.release.version }}
         uses: actions/checkout@v7
         with:
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ matrix.release.sha }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003
@@ -117,10 +112,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Join both platforms of ${{ matrix.distro }} under the release tags
+      - name: Join both platforms of ${{ matrix.distro }} ${{ matrix.release.version }} under its tags
         env:
           OWNER: ${{ github.repository_owner }}
-          VERSION: ${{ needs.prepare.outputs.version }}
-          IS_STABLE: ${{ needs.prepare.outputs.is_stable }}
+          VERSION: ${{ matrix.release.version }}
+          ALIASES: ${{ matrix.release.aliases }}
           PKGMGR_DISTRO: ${{ matrix.distro }}
         run: bash scripts/github/publish-containers/merge-container-images.sh