ci: publish editor image to GHCR

[luisalrp]

What does this PR do?

Adds a maintainer-triggered GHCR bootstrap workflow for existing editor release tags. Publication is opt-in, builds linux/amd64 and linux/arm64, and publishes only the selected version, never latest. Refs #770; switching the default deployment to a public registry image remains a follow-up.

• Preserves build: . in Compose and leaves the npm release workflow unchanged relative to the merged upstream main.
• Documents public-package setup, verification, and failure/recovery ownership before a future Compose transition.
• Excludes local TypeScript incremental state from Docker builds and adds source metadata to the image.

How to test

1. Run actionlint .github/workflows/docker.yml, ruby scripts/docker-workflow.test.rb, and docker compose config --quiet.
2. Build with docker buildx build --platform linux/amd64,linux/arm64 --output type=cacheonly . using a multi-platform builder.
3. Load each architecture locally, check /api/health, create a scene through the authenticated API, then recreate the container with the same data volume and verify the scene remains unchanged.
4. After merge, a maintainer can run the Docker workflow with an existing editor release version and publish disabled. Actual publication, anonymous pulls, and public multi-architecture manifest verification remain maintainer-owned.

Local verification: both architectures built successfully; arm64 scene creation returned 201; a new amd64 container recovered the identical scene from the shared volume. amd64 runtime was tested under emulation on Apple Silicon. No registry images were published. These tests used the local PR candidate, not a dispatched historical release tag.

Screenshots / screen recording

N/A — non-visual CI and deployment change.

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

---

Note

Low Risk
CI and documentation only; local Compose remains source-based and publishing is manual and version-tagged.

Overview
Adds a manual GitHub Actions Docker workflow that builds multi-platform (linux/amd64, linux/arm64) images from an existing @pascal-app/editor@<version> tag, with strict version validation, a package.json version check, and opt-in GHCR push tagged only as ghcr.io/<repo>:<version> (no latest).

Docker/CI hygiene: .dockerignore now excludes **/*.tsbuildinfo; the Dockerfile gets an OCI org.opencontainers.image.source label.

Docs & guardrails: SETUP.md clarifies that docker compose still builds from source (not GHCR) and documents maintainer bootstrap, verification, and failure-handling before a future Compose switch. A Ruby test (scripts/docker-workflow.test.rb) locks in workflow behavior (platforms, publish flag, no latest, release-tag checkout, compose still source-build, release workflow stays Docker-free).

^{Reviewed by Cursor Bugbot for commit bdc886a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 8bdf2076-e7df-4ba7-a14d-19a6b7dcc978

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b10b01d. Configure here.}

[Aymericr]

Blocking the current rollout shape: this changes the checked-in default from a working local build to ghcr.io/pascalorg/editor:latest before that package/tag exists and before its visibility can be made public. Immediately after merge, a fresh docker compose up -d can therefore fail at the official documented entry point until a maintainer runs a release and completes the manual organization-package step.

Please keep the source-build path working during bootstrap (or land publication first without switching Compose, verify an amd64/arm64 public manifest, then switch Compose in a follow-up). The release integration also needs a maintainer-reviewed rollback/partial-release decision because an image failure occurs after the editor npm publish step. I’m marking this for human release ownership rather than merging an unverified registry transition.

[luisalrp]

Thanks for catching the rollout gap. I've updated the PR in bdc886a to keep the existing source-build entry point intact and separate Docker publication from npm releases.

• Compose still uses build: .. A public-image default and promotion to latest are deferred to a follow-up after maintainer verification.
• Docker now has a manual workflow targeting an existing editor release tag. Publishing is opt-in and version-only, so an image failure cannot interrupt the npm release workflow or move latest.
• SETUP.md describes bootstrap, public visibility, anonymous multi-platform verification, and retry/rollback responsibilities. This is a proposed operational path for maintainer review, not an assumption that release approval has been granted.

Local checks passed: workflow lint, configuration tests, Compose validation, and builds for amd64 and arm64. I also created a scene via the API in arm64 and recovered the identical scene from a new amd64 container using the same volume. amd64 ran under emulation on Apple Silicon. The build check exposed local TypeScript incremental state entering the Docker context, so .dockerignore now excludes *.tsbuildinfo.

No image has been published. These tests cover the local candidate; a workflow run against a selected release tag and public GHCR pulls remain unverified. Please let me know whether this publication-first scope and recovery approach address your release-ownership concerns.