ci(docker): drop runtime smoke test, rely on Dockerfile static checks

GitHub-hosted macos-14 runners are themselves VMs and do not expose
Apple's Virtualization Framework to guests (no nested virtualization),
so colima --vm-type=vz --vz-rosetta aborts with VZErrorDomain Code=2
'Virtualization is not available on this hardware'. The earlier QEMU
TCG smoke test on ubuntu-latest, while functionally correct, takes
15-25 min to import pytantan through the pixi env.

Neither option is suitable for CI. Revert the workflow to a single
build-and-push job and rely on the Dockerfile's build-time guards
(file-presence check for pytantan/platform/*.so SIMD variants and
objdump scan of every shipped .so for AVX2 mnemonics) to ensure no
AVX2-tainted binary is ever published.

Refs: actions/runner-images#9460

Author: Jon Palmer

.github/workflows/docker.yml

@@ -30,11 +30,6 @@ jobs:
     name: Build funannotate2 image (linux/amd64)
     runs-on: ubuntu-latest
     timeout-minutes: 240
-    outputs:
-      staging_tag: ${{ steps.staging.outputs.tag }}
-      tags: ${{ steps.meta.outputs.tags }}
-      labels: ${{ steps.meta.outputs.labels }}
-      dockerhub_enabled: ${{ env.DOCKERHUB_ENABLED }}
     env:
       DOCKERHUB_ENABLED: ${{ secrets.DOCKERHUB_TOKEN != '' && 'true' || 'false' }}
 
@@ -57,13 +52,20 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Log in to GHCR
-        if: ${{ github.event.pull_request.head.repo.fork != true }}
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Log in to Docker Hub
+        if: ${{ github.event_name != 'pull_request' && env.DOCKERHUB_ENABLED == 'true' }}
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Extract image metadata
         id: meta
         uses: docker/metadata-action@v5
@@ -79,24 +81,15 @@ jobs:
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
             type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
 
-      # Compute a single transient "staging" tag in GHCR. The smoke-test job
-      # pulls this tag on a real Apple Silicon runner under Rosetta 2; the
-      # image is only copied to the release tags (latest, vX.Y, sha, ...) once
-      # the smoke test passes.
-      - name: Compute staging tag
-        id: staging
-        run: |
-          echo "tag=ghcr.io/nextgenusfs/funannotate2:staging-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
-
-      - name: Build image and push staging tag to GHCR
+      - name: Build and push
         id: build
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64
-          push: ${{ github.event.pull_request.head.repo.fork != true }}
-          tags: ${{ steps.staging.outputs.tag }}
+          push: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.push) }}
+          tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
@@ -106,114 +99,3 @@ jobs:
         if: steps.build.outputs.digest != ''
         run: echo "Digest=${{ steps.build.outputs.digest }}"
 
-  # Smoke-test the staged image on a real Apple Silicon (M1) macOS runner
-  # under Rosetta 2 -- exactly the environment where pytantan SIGILLs when
-  # built with AVX2. If `import pytantan` succeeds here the binary is safe
-  # to publish to the release tags.
-  smoke-test-rosetta:
-    name: Verify pytantan under Apple Rosetta 2 (macos-14)
-    needs: build
-    if: ${{ github.event.pull_request.head.repo.fork != true }}
-    runs-on: macos-14
-    timeout-minutes: 60
-    permissions:
-      contents: read
-      packages: read
-
-    steps:
-      - name: Install Rosetta 2
-        # macos-14 (Apple Silicon) GitHub runners do not ship with Rosetta
-        # pre-installed; `colima --vz-rosetta` needs it to set up the in-VM
-        # binfmt translator for linux/amd64 containers.
-        run: |
-          sudo softwareupdate --install-rosetta --agree-to-license
-
-      - name: Install colima and docker CLI
-        run: |
-          brew install colima docker
-
-      - name: Start colima with VZ + Rosetta 2 (amd64 acceleration)
-        run: |
-          colima start \
-            --arch aarch64 \
-            --vm-type=vz \
-            --vz-rosetta \
-            --cpu 3 \
-            --memory 6 \
-            --disk 30
-          docker info
-          docker version
-
-      - name: Dump colima logs on failure
-        if: failure()
-        run: |
-          echo "=== ha.stderr.log ==="
-          cat /Users/runner/.colima/_lima/colima/ha.stderr.log || true
-          echo "=== ha.stdout.log ==="
-          cat /Users/runner/.colima/_lima/colima/ha.stdout.log || true
-          echo "=== serial*.log ==="
-          for f in /Users/runner/.colima/_lima/colima/serial*.log; do
-            echo "--- $f ---"
-            cat "$f" || true
-          done
-
-      - name: Log in to GHCR
-        run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" \
-            | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-
-      - name: Pull staging image (linux/amd64)
-        run: |
-          docker pull --platform=linux/amd64 "${{ needs.build.outputs.staging_tag }}"
-          docker image inspect "${{ needs.build.outputs.staging_tag }}" \
-            --format '{{.Architecture}}/{{.Os}}'
-
-      - name: Smoke test pytantan import under Rosetta 2
-        run: |
-          set -euxo pipefail
-          docker run --rm --platform=linux/amd64 \
-            "${{ needs.build.outputs.staging_tag }}" \
-            /app/.pixi/envs/default/bin/python -c \
-              "import pytantan; from pytantan import Alphabet, RepeatFinder, default_scoring_matrix; print('pytantan smoke OK', pytantan.__version__)"
-
-  # Promote the staging tag to the real release tags. `docker buildx
-  # imagetools create` performs a registry-side copy of the manifest, so
-  # this finishes in seconds and never re-pulls the image bytes.
-  promote:
-    name: Promote staging image to release tags
-    needs: [build, smoke-test-rosetta]
-    if: ${{ github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || inputs.push) }}
-    runs-on: ubuntu-latest
-    env:
-      DOCKERHUB_ENABLED: ${{ needs.build.outputs.dockerhub_enabled }}
-
-    steps:
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log in to Docker Hub
-        if: ${{ env.DOCKERHUB_ENABLED == 'true' }}
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Copy staging tag to release tags
-        env:
-          STAGING_TAG: ${{ needs.build.outputs.staging_tag }}
-          TAGS: ${{ needs.build.outputs.tags }}
-        run: |
-          set -euxo pipefail
-          printf '%s\n' "${TAGS}" | while IFS= read -r tag; do
-            [ -z "${tag}" ] && continue
-            echo "Promoting ${STAGING_TAG} -> ${tag}"
-            docker buildx imagetools create --tag "${tag}" "${STAGING_TAG}"
-          done
-