Publish the stella-serve container image on every release

[macanderson]

What this does

Publishes packaging/docker/Dockerfile.serve on every release tag as ghcr.io/macanderson/stella-serve:<version> and :latest, for linux/amd64 and linux/arm64.

Nothing published the image before. The existing docker-serve.yml builds and smokes it on a pull request and throws it away, and release.yml ships only the CLI binary. Oxagen's node runs the engine as a container on arm64 and had no image to pin.

How

• Two native builds, one per runner architecture. Emulating the Rust build under QEMU takes hours.
• Each per-architecture image is smoked with the same script docker-serve.yml uses before its digest is pushed.
• Digests are pushed by digest only and tagged together at the end, so a half-published release never carries a tag that resolves on one architecture and not the other. The digests travel as artifacts because two matrix legs writing one job's outputs overwrite each other.
• RELEASING.md gains a short section on the image.

Evidence

Toolchain-free guards pass locally (make guards-fast, including action-pins over the four new pinned actions), and make prose and make line-citations pass on the release doc change. The workflow itself runs only on a tag push, so its first real run is the next release after this merges. No test was deleted.

No witness test: this is a CI change with no code path in the workspace.

Summary by Sourcery

Publish validated multi-architecture stella-serve container images alongside every release.

New Features:

• Publish the stella-serve container image for linux/amd64 and linux/arm64 on release tags, with version and latest tags in GHCR.

Enhancements:

• Build and smoke-test each architecture independently, then publish both digests as a single multi-architecture image tag.

CI:

• Add a release workflow that builds, validates, and publishes the stella-serve image, including manual versioned dispatches.

Documentation:

• Document the published engine container image, supported architectures, tagging guidance, and runtime configuration in RELEASING.md.

[sourcery-ai]

Sorry @macanderson, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 16 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR adds a pinned, release-driven GitHub Actions workflow that natively builds and smoke-tests the serve image for amd64 and arm64, publishes architecture digests to GHCR, and atomically creates version/latest multi-architecture tags; release documentation explains how to consume the image.

Sequence diagram for atomic multi-architecture image tagging

sequenceDiagram
    participant Tag as Release tag
    participant CI as GitHub Actions
    participant AMD64 as amd64 runner
    participant ARM64 as arm64 runner
    participant GHCR as GHCR
    Tag->>CI: Trigger publish workflow
    par Build amd64
        CI->>AMD64: Build Dockerfile.serve
        AMD64->>AMD64: smoke-serve-image.sh
        AMD64->>GHCR: Push amd64 image by digest
        AMD64-->>CI: Upload amd64 digest artifact
    and Build arm64
        CI->>ARM64: Build Dockerfile.serve
        ARM64->>ARM64: smoke-serve-image.sh
        ARM64->>GHCR: Push arm64 image by digest
        ARM64-->>CI: Upload arm64 digest artifact
    end
    CI->>CI: Download both digest artifacts
    CI->>GHCR: imagetools create version and latest tags over both digests
    CI->>GHCR: imagetools inspect version tag

Loading

File-Level Changes

Change	Details	Files
Add a release-triggered workflow that builds, validates, and publishes multi-architecture engine images.	Trigger on version tags, with optional manual dispatch and version resolution. Build native linux/amd64 and linux/arm64 images on separate runners. Verify the Docker builder Rust version matches the repository toolchain. Smoke each image before publishing its digest. Upload per-architecture digests as artifacts to avoid matrix-output overwrites. Create version and latest multi-architecture tags only after both digests are available.	.github/workflows/docker-serve-publish.yml
Document the published engine container and its intended release usage.	Document image names, supported architectures, validation and atomic tagging behavior. Recommend version tags for pinned deployments and latest for laptop use. Document runtime token environment variables.	RELEASING.md

Possibly linked issues

• the record: retract the stale claims, strike the rows that are wrong, and accept what shipped unproven #622: The PR adds CI builds and smoke tests for Dockerfile.serve, directly satisfying the issue’s image-build and runtime-verification acceptance.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.