Publish release images to GHCR

[chenbh]

We're currently publishing to Google Container Registry under a VMware account because of legacy reasons. We should migrate to GitHub Container Registry

[ollie-kane-CB]

The Google Container Registry is slated for shutdown on March 18th, 2025. After this point, kpack will no longer be installable.

https://cloud.google.com/artifact-registry/docs/transition/prepare-gcr-shutdown

I've been looking into this project a bit but don't yet know enough about how the current images are built and deployed. Once I learn a bit more, I can try my hand at updating this. Should the Maintainers provide links to relevant source code, that'd help my review process.

[chenbh]

The images are built and released using GHA. We first build dev images on every push to main and run tests using these images. If they pass acceptance, and we trigger a new release by pushing a new tag (see RELEASE.md), the GHA will promote all the images from the dev repo to the official repo.

The registry location and creds is currently passed in using repository GHA variables and secrets (so inaccessible to non-maintainers). But I think publishing directly to GHCR from GHA has some first class support and can be done without configuring any secrets (and so makes it possible for non-maintainers to contribute).

The main caveats I see is that:

1. We use pack to build and publish the images in a single step, this might have to be broken up into pieces (pack builds an OCI tarball, and we use some action to upload the tarball into GHCR) if we don't want to pass creds around. Or maybe the runner just has magical powers to write images without creds. IDK, I haven't played with GHCR at all.
2. We generate dev images all the time which might be broken. While these are currently public (so the community can play around with nightly and pre-release builds), it's uploaded to a different namespace to avoid confusion (gcr.io/cf-build-service-public/kpack-dev vs gcr.io/cf-build-service-public/kpack). From my 30 seconds skim of the docs, I'm not sure if we can do that level of separation with GHCR.

[ollie-kane-CB]

Fantastic response, if not a bit disappointingly complex issue.

It also answered a follow up I was going to ask which was "how can a guy try out the most recent bleeding-edge pushes that got accepted in my PR?"

I live entirely in the universe of GitLab. I'll try my hand at this github flavored way of doing things. perhaps i can help. I know how to do this in a jiffy in the other world, but I'm sure swapping providers is far too big of an investment.