From 407a7f6c42d3c3671ffc6c39f8032652115d2a20 Mon Sep 17 00:00:00 2001
From: B Marinov <dev@borismarinov.de>
Date: Sun, 23 Aug 2026 00:10:51 +0200
Subject: [PATCH 1/2] Push dev image on ci build

---
 .github/workflows/build.yml | 29 ++++++++++++++++++++++++++---
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 907dde0..053e7fd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -60,15 +60,38 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, test-e2e]
 
+    permissions:
+      contents: read
+      packages: write
+
     env:
       REGISTRY: ghcr.io
-      IMAGE_NAME: ${{ github.repository }}
+      IMAGE_NAME: ${{ github.repository }}-dev
 
     steps:
       - uses: actions/checkout@v6
 
+      - name: Log in to ghcr
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ${{ env.REGISTRY }} -u ${{ github.actor }} --password-stdin
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Build image
-        run: make docker-buildx PUSH= IMG=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+      - name: Build and push image
+        run: |
+          make docker-buildx PUSH=true \
+            IMG=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }} \
+            LABEL_ARGS="--label org.opencontainers.image.revision=${{ github.sha }} \
+                        --label org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+      - name: Tag main
+        run: |
+          docker buildx imagetools create \
+            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:main \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }}
+
+      - name: Log digest
+        run: |
+          docker buildx imagetools inspect \
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ github.sha }} \
+            --format '{{json .Manifest}}' | jq -r .digest

From 00b90ef19477bef4dbf0723a1269e56e9bc91c07 Mon Sep 17 00:00:00 2001
From: B Marinov <dev@borismarinov.de>
Date: Sun, 23 Aug 2026 00:17:53 +0200
Subject: [PATCH 2/2] Promote image from CI on release

---
 .github/workflows/release.yml | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d6bb120..ac3dd6e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,7 @@ jobs:
     env:
       REGISTRY: ghcr.io
       IMAGE_NAME: ${{ github.repository }}
+      DEV_IMAGE_NAME: ${{ github.repository }}-dev
       DOCKERHUB_IMAGE: docker.io/getclustered/garage-storage-controller
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
 
@@ -59,13 +60,21 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Build and push image
+      - name: Promote CI image
+        id: promote
+        env:
+          CI_IMAGE: ${{ env.REGISTRY }}/${{ env.DEV_IMAGE_NAME }}
+          RELEASE_IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          VERSION: ${{ steps.version.outputs.VERSION }}
+          COMMIT_SHA: ${{ github.sha }}
         run: |
-          make docker-buildx PUSH=true \
-            IMG=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }} \
-            LABEL_ARGS="--label org.opencontainers.image.version=${{ steps.version.outputs.VERSION }} \
-                        --label org.opencontainers.image.revision=${{ github.sha }} \
-                        --label org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          if ! digest=$(docker buildx imagetools inspect "${CI_IMAGE}:sha-${COMMIT_SHA}" --format '{{json .Manifest}}' | jq -re .digest); then
+            echo "::error::No CI image at ${CI_IMAGE}:sha-${COMMIT_SHA}. Tag a commit with a green build run on main."
+            exit 1
+          fi
+          docker buildx imagetools create -t "${RELEASE_IMAGE}:${VERSION}" "${CI_IMAGE}@${digest}"
+          echo "Promoted ${CI_IMAGE}@${digest} -> ${RELEASE_IMAGE}:${VERSION}"
+          echo "DIGEST=${digest}" >> "$GITHUB_OUTPUT"
 
       - name: Tag latest
         if: github.ref_type == 'tag'
@@ -109,8 +118,10 @@ jobs:
             crds-${{ steps.version.outputs.VERSION }}.yaml
           body: |
 
-            Controller image: `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}`
-            (mirror at `${{ env.DOCKERHUB_IMAGE }}`)
+            Controller image:
+            - `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}`
+            - `${{ env.DOCKERHUB_IMAGE }}:${{ steps.version.outputs.VERSION }}` (mirror)
+            - `${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.VERSION }}@${{ steps.promote.outputs.DIGEST }}` (digest-pinned)
 
             ## Changes