[Jochemp88]

What

A Publish image workflow that builds tesla_mtc for amd64 and arm64 and publishes it to ghcr.io/wessec/tesla_mtc, so users no longer have to build the image themselves. No code or documentation changes for users yet; those follow in a separate pull request once the image is available.

When it runs (.github/workflows/publish.yml)

• Release tag (v1.2.3):
  1. checks that the tag, version.py and a dated CHANGELOG.md entry agree;
  2. builds the image and runs a smoke test (runs as uid 1000, imports work, health check passes);
  3. builds for linux/amd64 and linux/arm64 and pushes the tags 1.2.3, 1.2, 1 and latest.
• By hand (Actions → Publish image → Run workflow) for an existing tag: to publish 1.2.1, which predates this workflow, or later to pick up security updates of the base image.
• Pull requests that change Dockerfile, .dockerignore, requirements.txt or this workflow: the same build without logging in or pushing. arm64 problems, for example from a Dependabot update of the base image, show up before merging. This pull request triggers that build itself.

Details

• 1 and latest only move for the newest release tag. Publishing an older release again never moves them backwards.
• Uses the built-in GITHUB_TOKEN with packages: write; no secrets. The OCI labels (org.opencontainers.image.source) link the package to this repository.
• provenance: false: a plain multi-platform image without attestation entries, which some NAS interfaces list as an "unknown" platform.
• README: a short Releasing section. Changelog: entry under Unreleased.

After merging

1. Publish 1.2.1 once: Run workflow with v1.2.1.
2. A new GHCR package may start out private. If an anonymous pull fails, the package owner has to switch it to public once: Package settings → Change visibility.
3. Then a follow-up pull request switches docker-compose.example.yml and the setup guide to the image.

Checked locally

• The workflow is valid against the GitHub workflow schema.
• The release-check logic was run against the real tags: v1.2.1 passes and is the newest. An older tag at its own commit passes but does not move 1/latest. A wrong version or a malformed tag is rejected.
• Not run locally: the multi-platform build and the push. This pull request's own run builds both platforms. Pushing is first exercised by the manual run for v1.2.1.

🤖 Generated with Claude Code