Split CI/CD workflows: lint, test, release with GitHub Releases

[alexei-led]

Summary

Replaces the monolithic build.yaml with properly separated workflows.

New Workflow Structure

cron.yaml      → Weekly: check util-linux for new version → auto-tag
                   ↓ (tag push)
release.yaml   → On tags: multi-arch build → push DockerHub + GHCR → GitHub Release
                   
ci.yaml        → On push/PR: Hadolint + ShellCheck → build (amd64) → integration tests

Changes

Removed: build.yaml

Was doing everything (CI + release) in one workflow. Replaced by two focused workflows.

New: ci.yaml

• Hadolint — lints Dockerfile for best practices (ignores DL3008 since we want latest build tools)
• ShellCheck — lints all shell scripts (nsenter-node.sh, tests/test-docker.sh)
• Build — single-arch amd64 build (fast, no push) with --load for local testing
• Test — runs tests/test-docker.sh against the built image
• Runs on all pushes and PRs

New: release.yaml

• Triggers on tag push (from cron.yaml auto-tag or manual git tag)
• Multi-arch build (amd64 + arm64) via QEMU + buildx
• Push to both registries: DockerHub (alexeiled/nsenter) + GHCR (ghcr.io/alexei-led/nsenter)
• GitHub Release — auto-created with:
  • Link to util-linux release
  • Docker pull commands
  • Auto-generated changelog
• Verification — pulls and runs --version from both registries after push

Unchanged: cron.yaml

Weekly check for new util-linux version → creates tag → triggers release.yaml.

Flow

New util-linux version detected (Monday cron)
  → cron.yaml creates git tag "2.41"
  → release.yaml triggers on tag push
  → builds linux/amd64 + linux/arm64
  → pushes alexeiled/nsenter:2.41 + :latest to DockerHub
  → pushes ghcr.io/alexei-led/nsenter:2.41 + :latest to GHCR
  → creates GitHub Release with changelog
  → verifies both images work

---

🤖 Automated by Marvin • alexei-led

[alexei-led]

Closing as superseded — master already incorporates split CI/CD workflows (ci.yaml + build-release.yaml) via PRs #9, #11, and #12, with additional improvements (native arm64 runners, GHCR-only, digest-based releases).