From 1e6dad7e2fc8a44ed1032ef4cf4e3c4fd958efcc Mon Sep 17 00:00:00 2001
From: Sergei Zimmerman <sergei@zimmerman.foo>
Date: Mon, 29 Dec 2025 23:01:54 +0300
Subject: [PATCH] upload-release: Also push to GHCR as part of the release
 process

(cherry picked from commit a1569458cccef17153f8f69dba7ef64c2f347b7c)
---
 .github/workflows/docker-push.yml    |  5 -----
 .github/workflows/upload-release.yml | 17 +++++++++++++++++
 maintainers/release-process.md       |  2 +-
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml
index d83b391e5..c4ccd1fe0 100644
--- a/.github/workflows/docker-push.yml
+++ b/.github/workflows/docker-push.yml
@@ -96,11 +96,6 @@ jobs:
         docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
         docker push $IMAGE_ID:$NIX_VERSION
         if [ "$IS_MASTER" = "true" ]; then
-          # FIXME: Do not tag master as latest. Upload to GHCR as part of
-          # releng instead. Possibly adapt this reusable workflow for the (yet
-          # nonexistent) release workflow.
-          docker tag nix:$NIX_VERSION $IMAGE_ID:latest
           docker tag nix:$NIX_VERSION $IMAGE_ID:master
-          docker push $IMAGE_ID:latest
           docker push $IMAGE_ID:master
         fi
diff --git a/.github/workflows/upload-release.yml b/.github/workflows/upload-release.yml
index 7beb3e8c9..82ce0c40b 100644
--- a/.github/workflows/upload-release.yml
+++ b/.github/workflows/upload-release.yml
@@ -14,6 +14,7 @@ on:
 permissions:
   contents: read
   id-token: write
+  packages: write
 jobs:
   release:
     runs-on: ubuntu-24.04
@@ -43,6 +44,12 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload release
         run: |
           ./maintainers/upload-release.pl \
@@ -50,3 +57,13 @@ jobs:
             --skip-git
         env:
           IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
+      - name: Push to GHCR
+        run: |
+          DOCKER_OWNER="ghcr.io/$(echo '${{ github.repository_owner }}' | tr '[A-Z]' '[a-z]')/nix"
+          ./maintainers/upload-release.pl \
+            ${{ inputs.eval_id }} \
+            --skip-git \
+            --skip-s3 \
+            --docker-owner "$DOCKER_OWNER"
+        env:
+          IS_LATEST: ${{ inputs.is_latest && '1' || '' }}
diff --git a/maintainers/release-process.md b/maintainers/release-process.md
index c9eb44bfb..b273fc09d 100644
--- a/maintainers/release-process.md
+++ b/maintainers/release-process.md
@@ -9,7 +9,7 @@ release:
 
 * Binary tarballs in https://releases.nixos.org/?prefix=nix/
 
-* Docker images
+* Docker images (arm64 and amd64 variants, uploaded to DockerHub and GHCR)
 
 * Closures in https://cache.nixos.org