Add manual branch image publish workflow (#224)

## Summary
- add a manual GitHub Actions workflow to publish controller images from
the current HEAD of a specified branch
- document the workflow briefly in the development section of the README
- I think this is important and a nice to have in this repo. As the
number of contributions grow, I would love to have a way to test
un-merged controller PR's against internal pipelines to validate if the
changes are backwards compat or not.

## Testing
- make lint-actions

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Shivs11

.dockerignore

@@ -31,7 +31,7 @@ internal/demo
 # CI/CD
 .github
 .goreleaser.yml
-.goreleaser.main.yml
+.goreleaser.publish-images.yml
 
 # Go
 go.work

.github/workflows/publish-image.yml

@@ -0,0 +1,96 @@
+name: publish-image
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: >
+          Branch to publish from (defaults to the branch selected in the UI).
+          The image will be tagged "main" for main, or "branch-<name>" otherwise.
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: publish-image-${{ inputs.branch || github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  publish-image:
+    runs-on: ubuntu-latest
+    env:
+      IMAGE_NAME: temporalio/temporal-worker-controller
+    steps:
+      - name: Determine ref and image tag
+        id: meta
+        shell: bash
+        env:
+          INPUT_BRANCH: ${{ inputs.branch }}
+        run: |
+          # Resolve the effective branch.
+          # workflow_dispatch may supply an explicit branch; otherwise
+          # fall back to the ref that triggered the workflow.
+          branch="${INPUT_BRANCH:-$GITHUB_REF_NAME}"
+
+          if [[ "$branch" == "main" ]]; then
+            echo "image_tag=main" >> "$GITHUB_OUTPUT"
+          else
+            sanitized="$(printf '%s' "$branch" | tr '[:upper:]' '[:lower:]' | sed -E 's#[^a-z0-9._-]+#-#g; s#(^-+|-+$)##g')"
+            if [[ -z "$sanitized" ]]; then
+              echo "Could not derive a Docker-compatible tag from branch '$branch'" >&2
+              exit 1
+            fi
+            echo "image_tag=branch-${sanitized}" >> "$GITHUB_OUTPUT"
+          fi
+
+          echo "ref=${branch}" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.meta.outputs.ref }}
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
+        with:
+          go-version-file: "go.mod"
+          check-latest: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PAT }}
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
+        with:
+          version: v2.11.2
+          args: release --config .goreleaser.publish-images.yml --snapshot --clean
+        env:
+          IMAGE_TAG: ${{ steps.meta.outputs.image_tag }}
+
+      - name: Push snapshot images
+        env:
+          IMAGE_TAG: ${{ steps.meta.outputs.image_tag }}
+        run: |
+          docker push "${IMAGE_NAME}:${IMAGE_TAG}-amd64"
+          docker push "${IMAGE_NAME}:${IMAGE_TAG}-arm64"
+
+      - name: Create and push manifest
+        env:
+          IMAGE_TAG: ${{ steps.meta.outputs.image_tag }}
+        run: |
+          docker manifest create "${IMAGE_NAME}:${IMAGE_TAG}" "${IMAGE_NAME}:${IMAGE_TAG}-amd64" "${IMAGE_NAME}:${IMAGE_TAG}-arm64"
+          docker manifest push "${IMAGE_NAME}:${IMAGE_TAG}"

.github/workflows/publish-main-image.yml

@@ -30,14 +30,14 @@ builds:
 checksum:
   disable: true
 
-# Only build Docker images with 'main' tag
+# Build Docker images with the tag provided by IMAGE_TAG
 dockers:
   - ids:
       - nix
     goos: linux
     goarch: amd64
     image_templates:
-      - "temporalio/temporal-worker-controller:main-amd64"
+      - "temporalio/temporal-worker-controller:{{ .Env.IMAGE_TAG }}-amd64"
     dockerfile: Dockerfile.goreleaser
     use: buildx
     build_flag_templates:
@@ -48,7 +48,7 @@ dockers:
       - --label=org.opencontainers.image.description=Temporal Worker Controller for Kubernetes
       - --label=org.opencontainers.image.url=https://github.com/temporalio/temporal-worker-controller
       - --label=org.opencontainers.image.source=https://github.com/temporalio/temporal-worker-controller
-      - --label=org.opencontainers.image.version=main
+      - --label=org.opencontainers.image.version={{ .Env.IMAGE_TAG }}
       - --label=org.opencontainers.image.created={{ time "2006-01-02T15:04:05Z07:00" }}
       - --label=org.opencontainers.image.revision={{ .FullCommit }}
       - --label=org.opencontainers.image.licenses=MIT
@@ -60,7 +60,7 @@ dockers:
     goos: linux
     goarch: arm64
     image_templates:
-      - "temporalio/temporal-worker-controller:main-arm64"
+      - "temporalio/temporal-worker-controller:{{ .Env.IMAGE_TAG }}-arm64"
     dockerfile: Dockerfile.goreleaser
     use: buildx
     build_flag_templates:
@@ -71,15 +71,15 @@ dockers:
       - --label=org.opencontainers.image.description=Temporal Worker Controller for Kubernetes
       - --label=org.opencontainers.image.url=https://github.com/temporalio/temporal-worker-controller
       - --label=org.opencontainers.image.source=https://github.com/temporalio/temporal-worker-controller
-      - --label=org.opencontainers.image.version=main
+      - --label=org.opencontainers.image.version={{ .Env.IMAGE_TAG }}
       - --label=org.opencontainers.image.created={{ time "2006-01-02T15:04:05Z07:00" }}
       - --label=org.opencontainers.image.revision={{ .FullCommit }}
       - --label=org.opencontainers.image.licenses=MIT
     extra_files:
       - LICENSE
 
 docker_manifests:
-  - name_template: "temporalio/temporal-worker-controller:main"
+  - name_template: "temporalio/temporal-worker-controller:{{ .Env.IMAGE_TAG }}"
     image_templates:
-      - "temporalio/temporal-worker-controller:main-amd64"
-      - "temporalio/temporal-worker-controller:main-arm64"
+      - "temporalio/temporal-worker-controller:{{ .Env.IMAGE_TAG }}-amd64"
+      - "temporalio/temporal-worker-controller:{{ .Env.IMAGE_TAG }}-arm64"

.goreleaser.main.yml .goreleaser.publish-images.yml.goreleaser.main.yml renamed to .goreleaser.publish-images.yml

@@ -164,6 +164,8 @@ We welcome all contributions! This includes:
 
 Want to try the controller locally? Check out the [local demo guide](internal/demo/README.md) for development setup.
 
+Need a test controller image from an unmerged branch? Run the `publish-branch-image` GitHub Actions workflow with the branch name.
+
 ## 📄 License
 
 This project is licensed under the [MIT License](LICENSE).