ci: publish images to GHCR on every main merge (#459)

The publish workflow only triggered on v* tags, and no tag has ever been
pushed — so ghcr.io/milvus-io/talon-* did not exist and every reference
to those images (docker-compose, Helm values, kubernetes manifests, docs)
was dead. Publishing sha-* and latest tags from every merge to main makes
the default branch continuously installable.

latest now tracks main only: the tag-triggered raw latest line also fired
on prereleases (v1.2.3-rc.1), and with two publishers the three matrix
jobs could race a concurrent tag and main run into a mixed latest across
images. flavor latest=false pins the single source.

The docker-build smoke job becomes PR-only — a merge to main runs the
real, publishing build, and running both would double the most expensive
job for no extra signal. Cache writes move to the main-branch publish
(PR- and tag-scoped cache entries are unreadable elsewhere and would only
churn the 10GB Actions cache quota).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: Thor-ChenBiao

.github/workflows/ci.yml

@@ -261,7 +261,10 @@ jobs:
     name: docker image build
     runs-on: ubuntu-latest
     # Smoke-build every container image on PRs (no push) so a broken Dockerfile
-    # fails CI. Publishing to GHCR happens separately on tags (release-images.yml).
+    # fails CI. A merge to main runs the real, publishing build in
+    # release-images.yml instead — running both would double the most expensive
+    # job in the repo for no extra signal, so this job is PR-only.
+    if: github.event_name == 'pull_request'
     steps:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
@@ -272,30 +275,33 @@ jobs:
           # The latency lab is a standalone stack; validate it parses too.
           docker compose -f deploy/testenv/docker-compose.yml config --quiet
           docker compose -f deploy/testenv/docker-compose.yml --profile tools config --quiet
+      # The builds read the main-seeded layer cache (written by
+      # release-images.yml on every merge) but do not write. This sacrifices
+      # layer reuse between pushes of one PR (entries written from a PR are
+      # only readable within that PR) to keep mode=max exports from churning
+      # the repository's 10GB Actions cache quota, which is already saturated
+      # by the rust-cache entries every other job depends on.
       - name: Build coordinator image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: deploy/docker/coordinator.Dockerfile
           push: false
           cache-from: type=gha,scope=coordinator
-          cache-to: type=gha,scope=coordinator,mode=max
       - name: Build worker image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: deploy/docker/worker.Dockerfile
           push: false
           cache-from: type=gha,scope=worker
-          cache-to: type=gha,scope=worker,mode=max
       - name: Build fuse image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: deploy/docker/fuse.Dockerfile
           push: false
           cache-from: type=gha,scope=fuse
-          cache-to: type=gha,scope=fuse,mode=max
 
   helm:
     name: helm chart

.github/workflows/release-images.yml

@@ -2,16 +2,24 @@ name: Release images
 
 # Build and publish the Talon container images to GHCR.
 #
-# On a version tag (vX.Y.Z) each image is pushed to
-# ghcr.io/<owner>/talon-<binary> with semver, major.minor, sha, and `latest`
-# tags. Pull requests do NOT run this workflow — the docker-build job in ci.yml
-# already smoke-builds every image (no push) on PRs.
+# Merges to main publish ghcr.io/<owner>/talon-<binary> with `latest` and
+# `sha-<short>` tags, so the images the compose files, Helm chart, and docs
+# reference always track the default branch. `latest` always converges on the
+# newest merged commit; rapid merges may coalesce queued runs (the per-ref
+# concurrency group keeps one pending slot), so an intermediate commit is not
+# guaranteed its own sha-* image. A version tag (vX.Y.Z) additionally
+# publishes semver and major.minor tags; `latest` tracks main only, so a tag
+# publish racing a main publish can never leave `latest` mixed across the
+# three images. Pull requests do NOT run this workflow — the docker-build job
+# in ci.yml already smoke-builds every image (no push).
 
 on:
   push:
+    branches:
+      - main
     tags:
       - "v*"
-  # Allow a manual publish of `latest` from the default branch.
+  # Allow a manual publish from the default branch.
   workflow_dispatch:
 
 # Least-privilege: only the GHCR push needs package write; the built-in
@@ -55,12 +63,16 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ghcr.io/${{ github.repository_owner }}/talon-${{ matrix.image }}
+          # latest=false disables the implicit `latest` that semver tags would
+          # otherwise add (it would also fire on prereleases like v1.2.3-rc.1);
+          # `latest` comes only from the default-branch line below.
+          flavor: |
+            latest=false
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=sha
             type=raw,value=latest,enable={{is_default_branch}}
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push
         uses: docker/build-push-action@v6
@@ -71,4 +83,7 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha,scope=${{ matrix.image }}
-          cache-to: type=gha,scope=${{ matrix.image }},mode=max
+          # Only main seeds the shared layer cache: entries written from tag
+          # refs are unreadable by other refs, so writing them would only churn
+          # the repository's 10GB Actions cache quota.
+          cache-to: ${{ github.ref == 'refs/heads/main' && format('type=gha,scope={0},mode=max', matrix.image) || '' }}