[etwk]

Changes

• Publish Linux amd64 images to ghcr.io/xllent-ai/steady-proxy on every push to main (latest) and every published release (its release tag).
• Include a full sha-<commit> image tag and executable build metadata; release publishing does not move latest.
• Call the reusable image publisher after the existing release job, since releases created with GITHUB_TOKEN do not trigger another release-event workflow.
• Use the automatic token with job-scoped packages: write, disable persisted checkout credentials, and cache Buildx layers.
• Document image usage, GHCR visibility/access, and retrying a failed release-image job.

Verification

• actionlint passed for all workflows.
• Local Docker Buildx Linux amd64 build passed using the workflow's metadata script and build arguments.
• Built container passed CLI --version and HTTP /__version checks, including commit/build timestamp and nonroot execution.
• Executed the actual Docker metadata action for main, manually published release, and workflow-created release contexts; verified lowercase registry names, exact expected tags, and no release overwrite of latest.
• Precommit review found Git-context metadata fails after SHA-only shallow checkout. Reproduced the failure, switched metadata to workflow context, and verified main/manual-release/automated-release tags with the same detached shallow fixture.

No new release is created by this PR. The first actual registry push occurs after merge to main.

[etwk]

Precommit Codex review is clean after fixing the detached-HEAD metadata issue. The original failure was reproduced with a SHA-only shallow checkout; the corrected workflow passed the actual Docker metadata action for main, manually published releases, and workflow-created releases. actionlint also passed. Waiting for GitHub Go and Docker CI before merging.

[etwk]

Merged as ef446ec. Post-merge Go/Docker CI passed: https://github.com/Xllent-AI/steady-proxy/actions/runs/39113657562 . First GHCR publication passed: https://github.com/Xllent-AI/steady-proxy/actions/runs/39113657496 . Both latest and sha-ef446ec62a31db39c94af130657e611f93b55dd3 were pushed with digest sha256:aa4041decfe5c93ca8f3870846b0587225c4ca08d07f3413bf2721fa0481cce7. Anonymous pull verification returned unauthorized; the local CLI token also lacks read:packages. Remaining access step: set the package visibility to Public in GitHub package settings (or provide authorized package-read access), then verify the registry pull and published-container runtime. No release was created.

[etwk]

Final rollout verification passed after the package visibility change. Using a fresh empty Docker configuration (no registry credentials), both latest and sha-ef446ec62a31db39c94af130657e611f93b55dd3 pulled successfully and matched the published digest sha256:aa4041decfe5c93ca8f3870846b0587225c4ca08d07f3413bf2721fa0481cce7. The actual GHCR image is Linux amd64, runs nonroot, and passed CLI --version and HTTP /__version checks for version 0.1.0, merge commit ef446ec, build timestamp 2026-10-18T09:00:53Z, and clean working-tree metadata. Verification container and temporary Docker configuration were removed. Rollout complete; no release was created.