ci(docker): add CI build and push workflows for docker-new

[xmfcx]

• Parent issue: Migrate and replace old Docker pipeline with docker-new #7003

• Add three CI workflows that build and push docker-new images to ghcr.io/autowarefoundation/autoware-new

• Extend docker-bake.hcl with CI variables (REGISTRY, PLATFORM, TAG_*) and a ctx() function for cross-job registry context resolution

• Add "Pull from GHCR" documentation to README

Why

PR 1 (#7004) landed the Dockerfiles, HCL, and ansible playbook for local builds. This PR adds the CI pipeline so images are automatically built and published on every push to main and on semver tags. Each distro (jazzy/humble) builds in 4 sequential groups (base -> core -> universe/universe-cuda) with dual-arch (amd64 + arm64) support and multi-arch manifests.

Workflow architecture

docker-build-and-push-new.yaml  (orchestrator: changed-files gate, triggers per-distro)
  └─ docker-build-pipeline-new.yaml  (per-distro: chains groups sequentially)
       └─ docker-build-new.yaml  (reusable: builds one bake group, dual-arch + manifests)

HCL changes

• docker-new/docker-bake.hcl: tags() now generates registry tags when REGISTRY is set (local builds unchanged). ctx() switches between target: (local) and docker-image:// (CI) for cross-group dependencies.

Tag scheme

Trigger	Tag example
Push to main	base-jazzy, base-jazzy-20260413
Semver tag 1.2.3	base-jazzy-1.2.3
workflow_dispatch from branch	base-jazzy-feat-foo

---

• Depends on feat(docker): add new Dockerfiles, HCL bake config, and ansible playbook #7004

Test plan

• Validate HCL locally (no REGISTRY set, should produce only local tags):

  docker buildx bake -f docker-new/docker-bake.hcl --print 2>/dev/null | jq '.target.base.tags'
  # Expected: ["autoware:base-jazzy"]

• Validate HCL with CI variables:

  REGISTRY=ghcr.io/test PLATFORM=amd64 TAG_DATE=20260413 docker buildx bake -f docker-new/docker-bake.hcl --print 2>/dev/null | jq '.target.base.tags'
  # Expected: ["ghcr.io/test:base-jazzy-amd64", "ghcr.io/test:base-jazzy-20260413-amd64"]

• Validate ctx() switches to registry in CI mode:

  REGISTRY=ghcr.io/test PLATFORM=amd64 USE_REGISTRY_CONTEXTS=true docker buildx bake -f docker-new/docker-bake.hcl --print 2>/dev/null | jq '.target["core-dependencies"].contexts["autoware-base"]'
  # Expected: "docker-image://ghcr.io/test:base-jazzy-amd64"

• Full pipeline run on fork: https://github.com/xmfcx/autoware/actions/runs/24334918069
  • Published images: https://github.com/xmfcx/autoware/pkgs/container/autoware-new
  • Build cache: https://github.com/xmfcx/autoware/pkgs/container/autoware-buildcache-new
• Trigger workflow_dispatch on upstream after merge and verify the full pipeline runs

Integration test branches

Test branches that use the new docker images in downstream repo CI:

autoware_core:

• Branch: https://github.com/autowarefoundation/autoware_core/tree/ci/docker-new/test-core-dependencies
• Latest dispatch: https://github.com/autowarefoundation/autoware_core/actions/runs/24359453585

autoware_universe:

• Branch: https://github.com/autowarefoundation/autoware_universe/tree/ci/docker-new/test-universe-dependencies
• Latest dispatch: https://github.com/autowarefoundation/autoware_universe/actions/runs/24350888807

[github-actions]

Thank you for contributing to the Autoware project!

🚧 If your pull request is in progress, switch it to draft mode.

Please ensure:

• You've checked our contribution guidelines.
• Your PR follows our pull request guidelines.
• All required CI checks pass before marking the PR ready for review.