Publish ironclaw-worker image from Dockerfile.worker

[Evrard-Nil]

Summary

• Build and push nearaidev/ironclaw-worker from Dockerfile.worker in the same Docker workflow
• Both images share the same tag scheme: :version, :latest, :sha-xxx, and manual override tags
• Separate GHA cache scope (worker) to avoid cache collisions with the main image

This lets ironclaw-dind pull nearaidev/ironclaw-worker:latest for sandbox baking instead of cloning the repo and building from source each time.

Test plan

• Run workflow_dispatch with a tag override — both images should be pushed
• Verify nearaidev/ironclaw-worker tags appear on Docker Hub
• Verify ironclaw-dind bake step can pull the worker image

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

Updates the Docker publishing workflow to also build and push a separate nearaidev/ironclaw-worker image from Dockerfile.worker, enabling consumers to pull a prebuilt worker image instead of building from source.

Changes:

• Add a second image name and generate parallel tag sets for the worker image.
• Build and push ironclaw-worker from Dockerfile.worker with an isolated GHA cache scope.
• Expand the workflow summary to list tags for both images.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

actions/checkout is given an empty ref for non-scheduled runs (... || ''). checkout expects a valid ref/SHA and an empty string can cause the step to fail. Use a non-empty fallback like github.ref/github.sha, or split into two checkout steps with if: github.event_name == 'schedule' and no ref override otherwise.

Suggested change

	- name: Checkout
	uses: actions/checkout@v4
	with:
	ref: ${{ github.event_name == 'schedule' && 'staging' || '' }}
	- name: Checkout (scheduled staging build)
	if: github.event_name == 'schedule'
	uses: actions/checkout@v4
	with:
	ref: staging
	- name: Checkout
	if: github.event_name != 'schedule'
	uses: actions/checkout@v4

[Copilot]

On schedule runs you checkout the staging branch, but SHA="sha-${GITHUB_SHA::7}" will still be the scheduled event SHA (default branch), not the checked-out staging commit. This will push misleading sha-... tags and also break any downstream logic that assumes the sha tag matches the built contents. Derive the SHA from the checked-out workspace (e.g., git rev-parse --short HEAD) for tagging (and for sha_tag).

Suggested change

	SHA="sha-${GITHUB_SHA::7}"
	SHORT_SHA="$(git rev-parse --short HEAD)"
	SHA="sha-${SHORT_SHA}"