Upload releases to GHCR

[jprenken]

Fixes #8334

[jprenken]

I ran this new release workflow on a forked repo, with the GitHub account name changed.

• Workflow output: https://github.com/jprenken/boulder/actions/runs/17571401568/job/49908137773
• Resulting GHCR page: https://github.com/jprenken/boulder/pkgs/container/boulder

[beautifulentropy]

In #7891 we began building and publishing a container for ct-test-srv. Since then, we’ve updated this container and we're now tagging and uploading it as a Boulder container as well.

If we’re shipping the same container to different repositories:

1. We should consider adding a TODO to remove the ct-test-srv push so we’re (eventually) not pushing two identical artifacts to different repos, and
2. we might also want to rename these steps to make it clearer that we’re building a Boulder container and pushing it as both Boulder and ct-test-srv.

[aarongable]

Since then, we’ve updated this container and we're now tagging and uploading it as a Boulder container as well.

I don't think that's what's happening here? The boulder container is built on line 36 using container-build.sh; the ct-test-srv container is built on line 61 via direct invocation of docker buildx build. It's is a little spooky action at a distance that "docker push" pushes the right container image to the right repository just given a string name, but the two pushes on lines 69 and 72 are pushing different things to different places.

[beautifulentropy]

I don't think that's what's happening here? The boulder container is built on line 36 using container-build.sh; the ct-test-srv container is built on line 61 via direct invocation of docker buildx build. It's is a little spooky action at a distance that "docker push" pushes the right container image to the right repository just given a string name, but the two pushes on lines 69 and 72 are pushing different things to different places.

Thanks for clarifying, Aaron. We could make this relationship a lot clearer by changing the step name on line 33 from "Build .deb" to "Build boulder container and .deb". We should also update this line at the same time or in a follow up PR.