ci: publish container images from releases

[legendtkl]

Summary

Publish prebuilt backend and frontend images through GitHub Actions so deployments normally pull a matched image pair instead of compiling TokenHub on the target host. The frontend now reads its backend API URL at server runtime, allowing one immutable frontend image to be configured after publication.

The publication workflow intentionally does not run for pull requests or merges to main. It runs for published GitHub Releases or an explicit manual edge / manual-* publication.

Related Issue

N/A

Changes

• Add a pinned GitHub Actions workflow that builds linux/amd64 and linux/arm64 backend/frontend images, publishes provenance attestations, and promotes final tags only after both staging images succeed.
• Validate Release tags as a strict SemVer subset, isolate manual tags from latest and release tags, serialize publication runs, and reuse per-image GitHub Actions caches.
• Build the Next.js frontend as a standalone image and inject TOKENHUB_API_BASE_URL at server runtime. Keep NEXT_PUBLIC_API_BASE_URL as a documented one-cycle compatibility fallback.
• Configure Compose to use matching ghcr.io/astaxie/tokenhub-{backend,frontend} tags. Default deployments use the model catalog embedded in the backend image; --model-catalog provides an explicit override.
• Update deploy/install.sh to pull published images by default, support explicit local builds, and fall back to a local build only when the default latest tag is temporarily unavailable. Explicit version tags never silently fall back.
• Add installer coverage and synchronize deployment guidance across English, Simplified Chinese, and Japanese documentation.

Type of Change

• Bug fix
• New feature
• Refactor or maintenance
• Documentation
• Deployment or configuration

Verification

• Backend: gofmt on changed Go files, go test ./..., and go vet ./...
• Frontend: npm run typecheck and npm run build
• SDK smoke tests against a compatible backend
• Docker Compose configuration rendered successfully
• Other focused or manual verification described below

Verification details:

• No Go files changed; go test ./... and go vet ./... passed from backend/.
• ./frontend/node_modules/.bin/tsc --noEmit and npm run build passed.
• The combined npm run typecheck entry point remains blocked by the existing missing frontend/scripts/check-source-lines.mjs file on the base branch; direct TypeScript validation passed.
• SDK smoke tests were not run because this change does not alter the OpenAI-compatible API contract. Container-level backend and frontend smoke tests were run instead.
• bash -n deploy/install.sh deploy/install_test.sh start.sh and ./deploy/install_test.sh passed.
• docker compose ... config passed for SQLite, bundled PostgreSQL, remote PostgreSQL, the legacy API URL fallback, and the custom model catalog override.
• actionlint v1.7.7 and git diff --check passed.
• A real fork publication completed successfully:
  • Bootstrap run: https://github.com/legendtkl/TokenHub/actions/runs/30002694504
  • Final workflow_dispatch run using the production workflow: https://github.com/legendtkl/TokenHub/actions/runs/30003996190
  • Published ghcr.io/legendtkl/tokenhub-backend:manual-e2e-dispatch-20260723 and ghcr.io/legendtkl/tokenhub-frontend:manual-e2e-dispatch-20260723.
  • Both manifests contain linux/amd64 and linux/arm64; both attestations pass gh attestation verify.
  • Anonymous pulls with an empty Docker configuration succeeded.
  • The pulled linux/arm64 containers started successfully, the backend /readyz endpoint returned healthy, and the frontend rendered the runtime API URL.
• The upstream repository is read-only for the test account, so the real publication used the writable fork namespace. The first upstream Release must still confirm astaxie package visibility and repository-level package settings.

Compatibility, Security, and Operations

• OpenAI-compatible /v1 API impact: None.
• Security or credential-handling impact: The workflow uses the job-scoped GITHUB_TOKEN, grants write permissions only to build/promotion jobs, pins third-party Actions to commit SHAs, and publishes provenance attestations. No registry credentials are added to the repository.
• Database, environment, or deployment impact: Adds TOKENHUB_IMAGE_TAG and runtime TOKENHUB_API_BASE_URL. Existing NEXT_PUBLIC_API_BASE_URL deployments retain a compatibility fallback. Default deployments now use the model catalog embedded in the selected backend image.
• Rollout and rollback considerations: Merge alone does not publish images. Publish a Release, confirm both GHCR packages are anonymously readable, then use an exact release tag for production. ./deploy/install.sh --build remains available for source builds, and deployments can roll back by selecting an earlier matching image tag.

Checklist

• Tests were added or updated for behavior changes, or the reason they are unnecessary is documented.
• No credentials, local .env files, databases, backups, or runtime logs are included.
• Environment variable changes are synchronized across examples, Compose, start.sh, and deployment documentation where applicable.
• Shared user-facing behavior is documented consistently in English, Simplified Chinese, and Japanese where applicable.
• data/model-catalog.yaml remains tracked and catalog changes were reviewed where applicable.
• git diff --check passes.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.