containers/ws: Publish image more frequently, only when needed

[marvinruder]

As mentioned in #21969 (comment), the current method of pushing new cockpit/ws images to the registry is not optimal, as an image is pushed in regular intervals regardless of whether the Cockpit version changed. To not push an excessive number of images, a weekly schedule has been adopted, so that the container releases can be up to 7 days late after a new release landed in the Fedora repositories (this has also been discussed in #21950).

This PR proposes the following changes:

• Images are built every day.
• The Cockpit version of the new image is compared against the image tags in the registry. If an image with that version is already present, the newly built image is redundant and will not be pushed.
• To retain the capability of overwriting e.g. a corrupted image in the registry, a flag FORCE_PUSH for manual workflow dispatches has been added. If set to true, the image will be pushed to the registry regardless of whether an image with the current version is already present.

[martinpitt]

Thank you! In our defence, the regular rebuilds were somewhat intended to pick up security updates etc. from the distro even if cockpit didn't change. But we release often enough that this doesn't matter so much, and cockpit is the primary attack vector anyway. So I agree to this change.

Let's just fix the version check. Also, can you please reorder the commit subject to "containers/ws: Publish image..."?

[marvinruder]

Thank you! In our defence, the regular rebuilds were somewhat intended to pick up security updates etc. from the distro even if cockpit didn't change.

Ah, I see.

But we release often enough that this doesn't matter so much, and cockpit is the primary attack vector anyway.

Also, in case some major vulnerability in the base image is found, you can still publish a new image immediately using the FORCE_PUSH parameter.

So I agree to this change.

Let's just fix the version check. Also, can you please reorder the commit subject to "containers/ws: Publish image..."?

All done, thanks!

[martinpitt]

Very cool, thanks! GitHub currently has an outage, so will have to prod the tests a bit.