Ramon Roche d74db56a06 ci(container): harden dev_container workflow against cache-export flakes
Three related fixes to prevent a repeat of the v1.17.0-rc2 incident, where a
post-push GHA cache-export 404 failed the arm64 build after both registry
pushes had already succeeded, fail-fast cancelled amd64, and the deploy job
was skipped, leaving the registries with only a partial arm64 publish and no
multi-arch manifest.

- Mark cache export as non-fatal via ignore-error=true on cache-to. A
  successful registry push should never be undone by a cache-layer flake.
  This alone would have let rc2 publish correctly.

- Decouple the deploy job from the build job's exit code. Change its if:
  gate to !cancelled() + setup success only, and promote the existing
  "Verify Images Exist Before Creating Manifest" step from a warning into
  a hard precondition. Deploy now runs whenever both per-arch tags actually
  exist in the registries, which is its real precondition, and fails loudly
  if a tag is missing.

- Bump every action to the current major (runs-on/action v2,
  actions/checkout v5, docker/login-action v4, docker/setup-buildx-action v4,
  docker/build-push-action v7, docker/metadata-action v6). This gets the
  workflow off Node 20 before GitHub's June 2 2026 forced runtime switch
  and keeps runs-on/action on the same major as the runs-on platform.

Signed-off-by: Ramon Roche <mrpollo@gmail.com>
2026-04-07 14:32:48 -06:00
..
2025-07-02 14:43:55 -07:00