ci: Drop the main computerd image

Keep the mutable image workflow focused on release candidates. Green CI on the release branch updates the GHCR next tag; production publishing continues to create versioned and latest tags after merge.

Author: aron-cf

…ithub/workflows/main-computerd-image.yml …ithub/workflows/next-computerd-image.yml.github/workflows/main-computerd-image.yml renamed to .github/workflows/next-computerd-image.yml .github/workflows/main-computerd-image.yml renamed to .github/workflows/next-computerd-image.yml

@@ -1,19 +1,19 @@
-# Build computerd images from commits that passed CI. The mutable :main tag
-# follows main, while :next follows the changesets Version Packages branch.
+# Build the computerd image from the commit that passed CI on the release
+# branch. The mutable :next tag lets release candidates use the versioned
+# package and matching daemon before publication.
 
-name: Computerd branch image
+name: Next computerd image
 
 on:
   workflow_run:
     workflows: ["CI"]
-    branches: [main, release]
+    branches: [release]
     types: [completed]
   workflow_dispatch: {}
 
 concurrency:
-  # Keep the main and next publishers independent while allowing newer commits
-  # on either branch to cancel stale image builds for the same tag.
-  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
+  # Only the newest release commit may publish the mutable :next tag.
+  group: ${{ github.workflow }}
   cancel-in-progress: true
 
 permissions:
@@ -33,18 +33,12 @@ jobs:
               github.event.workflow_run.event == 'push' ||
               github.event.workflow_run.event == 'workflow_dispatch'
             ) &&
-            (
-              github.event.workflow_run.head_branch == 'main' ||
-              github.event.workflow_run.head_branch == 'release'
-            ) &&
+            github.event.workflow_run.head_branch == 'release' &&
             github.event.workflow_run.head_repository.full_name == github.repository
           ) ||
           (
             github.event_name == 'workflow_dispatch' &&
-            (
-              github.ref == 'refs/heads/main' ||
-              github.ref == 'refs/heads/release'
-            )
+            github.ref == 'refs/heads/release'
           )
         )
       }}
@@ -58,26 +52,6 @@ jobs:
           ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
           fetch-depth: 1
 
-      - name: Select the mutable image tag
-        id: image
-        env:
-          SOURCE_BRANCH: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_branch || github.ref_name }}
-        run: |
-          case "$SOURCE_BRANCH" in
-            main)
-              tag=main
-              ;;
-            release)
-              tag=next
-              ;;
-            *)
-              echo "Unsupported source branch: $SOURCE_BRANCH" >&2
-              exit 1
-              ;;
-          esac
-          echo "branch=$SOURCE_BRANCH" >> "$GITHUB_OUTPUT"
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-
       - uses: ./.github/actions/install
 
       - name: Install system dependencies
@@ -118,29 +92,25 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       # A slower CI run for an older commit can finish after a newer one. Do
-      # not let that run replace the newer branch image.
-      - name: Verify the source branch has not advanced
-        id: branch-sha
-        env:
-          SOURCE_BRANCH: ${{ steps.image.outputs.branch }}
+      # not let that run replace the newer release image.
+      - name: Verify the release branch has not advanced
+        id: release-sha
         run: |
-          git fetch --no-tags --depth=1 origin "$SOURCE_BRANCH"
+          git fetch --no-tags --depth=1 origin release
           if [[ "$(git rev-parse HEAD)" != "$(git rev-parse FETCH_HEAD)" ]]; then
-            echo "$SOURCE_BRANCH advanced while this image was building; skipping the push"
+            echo "release advanced while this image was building; skipping the push"
             echo "current=false" >> "$GITHUB_OUTPUT"
           else
             echo "current=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Build and push the branch image
-        if: steps.branch-sha.outputs.current == 'true'
-        env:
-          IMAGE_TAG: ${{ steps.image.outputs.tag }}
+      - name: Build and push the next image
+        if: steps.release-sha.outputs.current == 'true'
         run: |
           docker buildx build \
             --platform linux/amd64 \
             --push \
             --provenance=false \
-            --tag "ghcr.io/cloudflare/computer-computerd-linux-x64:$IMAGE_TAG" \
+            --tag ghcr.io/cloudflare/computer-computerd-linux-x64:next \
             --file packages/computer-computerd-linux-x64/Dockerfile \
             packages/computer-computerd-linux-x64

packages/computer-computerd-linux-x64/README.md

@@ -35,12 +35,10 @@ ENTRYPOINT ["/usr/local/bin/computerd"]
 ```
 
 Pin the image version explicitly. `latest` is fine for experimentation but
-can bite when wire-protocol changes land. The `Computerd branch image`
-workflow publishes `ghcr.io/cloudflare/computer-computerd-linux-x64:main`
-after successful CI on `main` and
-`ghcr.io/cloudflare/computer-computerd-linux-x64:next` after successful CI on
-the `release` branch. Use these mutable tags only for tests and examples that
-intentionally track their branches.
+can bite when wire-protocol changes land. The `Next computerd image` workflow
+publishes `ghcr.io/cloudflare/computer-computerd-linux-x64:next` after
+successful CI on the `release` branch. Use this mutable tag only for tests and
+examples that intentionally track release candidates.
 
 ## Configuration