upload-release: Also push to GHCR as part of the release process

(cherry picked from commit a1569458cc)

.github/workflows/docker-push.yml

@@ -96,11 +96,6 @@ jobs:
         docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
         docker push $IMAGE_ID:$NIX_VERSION
         if [ "$IS_MASTER" = "true" ]; then
-          # FIXME: Do not tag master as latest. Upload to GHCR as part of
-          # releng instead. Possibly adapt this reusable workflow for the (yet
-          # nonexistent) release workflow.
-          docker tag nix:$NIX_VERSION $IMAGE_ID:latest
           docker tag nix:$NIX_VERSION $IMAGE_ID:master
-          docker push $IMAGE_ID:latest
           docker push $IMAGE_ID:master
         fi

.github/workflows/upload-release.yml

@@ -14,6 +14,7 @@ on:
 permissions:
   contents: read
   id-token: write
+  packages: write
 jobs:
   release:
     runs-on: ubuntu-24.04
@@ -43,6 +44,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload release
         run: |
           ./maintainers/upload-release.pl \
@@ -50,3 +57,13 @@ jobs:
             --skip-git
         env:
           IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
+      - name: Push to GHCR
+        run: |
+          DOCKER_OWNER="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[A-Z]' '[a-z]')/nix"
+          ./maintainers/upload-release.pl \
+            ${{ inputs.eval_id }} \
+            --skip-git \
+            --skip-s3 \
+            --docker-owner "$DOCKER_OWNER"
+        env:
+          IS_LATEST: ${{ inputs.is_latest && '1' || '' }}

maintainers/release-process.md

@@ -9,7 +9,7 @@ release:
 
 * Binary tarballs in https://releases.nixos.org/?prefix=nix/
 
-* Docker images
+* Docker images (arm64 and amd64 variants, uploaded to DockerHub and GHCR)
 
 * Closures in https://cache.nixos.org