[jiangxt2]

Description

Add a GitHub Actions workflow for publishing the Tributo runtime image. It supports a manual dispatch for the released 1.2.0 source and automatically runs when a stable GitHub Release with a tributo-X.Y.Z tag is published. The manual path verifies the pinned 1.2.0 commit; the automatic path checks out the release tag and verifies its commit and package version.

The publisher derives an architecture-specific tag from the build manifest, verifies the registry digest against the local image, refuses to overwrite a tag that points to a different image, and records a registry-backed ImageProfile. The workflow requires tosche911/tributo-runtime to be publicly readable and uses the repository Actions username variable and token secret.

This change adds publication automation and documentation. It does not change Tributo runtime APIs or dependency versions. Images built by this workflow target Linux arm64 CPU; native amd64 and GPU support are not claimed.

Related issues

None.

Additional information

• uv run --locked --no-sync pytest -o addopts= tests/tools/test_build_tributo_image.py tests/tools/test_publish_tributo_image.py — 31 passed.
• pre-commit run --files tools/publish_tributo_image.py tests/tools/test_publish_tributo_image.py — Ruff format and lint passed.
• actionlint .github/workflows/publish-runtime-image.yml — passed.
• uv run --locked --no-sync python scripts/ci_test_plan.py audit — passed (23 suites, 8 ordered path rules).
• The CI unit suite passed on Python 3.12 and 3.13; documentation static contracts, strict Sphinx build, and spelling checks passed.
• Docker image build and Docker Hub publication were not run during local validation; the workflow performs these operations when dispatched for Tributo 1.2.0 or triggered by a later stable Release.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; both previous findings are addressed, and no new actionable issue was found.

Summary

Adds an arm64 runtime-image publisher for stable GitHub Releases and a manual path for Tributo 1.2.0.

• Stable releases can publish versioned arm64 runtime images.

Both previous findings are addressed: the builder now shares the runner's Docker image store, and manual and automatic publication of the same release are serialized.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Manual dispatch or stable release] --> B[Check release source and version]
  B --> C[Build and check arm64 image]
  C --> D{Destination tag exists?}
  D -->|No| E[Push image]
  D -->|Yes| F[Require matching image]
  E --> G[Check registry digest]
  F --> G
  G --> H[Save published ImageProfile and artifacts]

Loading

_{Reviews (2) · Last reviewed commit: "fix(ci): use daemon Buildx for runtime p..." · Reviewed by Greptile}