feat(ci): publish omnigraph-server image to Docker Hub alongside GHCR

[aaltshuler]

Docker Hub (docker.io/modernrelay/omnigraph-server) becomes the primary
anonymous-pull distribution channel; the step no-ops when the
DOCKERHUB_* secrets are unset so forks and the GHCR-only path keep
working. Same latest-tag policy as GHCR (real tag pushes only, never
dispatch backfills). Docs updated in the same PR (ci.md, deployment.md).

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

---

Greptile Summary

This PR adds Docker Hub (docker.io/modernrelay/omnigraph-server) as a second image distribution channel alongside GHCR, making it the primary anonymous-pull target. The workflow implementation uses a continue-on-error + fail-gate step pattern so a Hub failure doesn't suppress the GHCR digest summary, and docs are updated in the same change.

• The Push to Docker Hub step is gracefully skipped when DOCKERHUB_* secrets are absent, keeping forks and GHCR-only paths working without modification.
• The Report pinned digests step was updated to use a grep -E "^(docker\.io/)?..." pattern that correctly handles both docker.io/-prefixed and bare Docker Hub RepoDigests formats across Docker versions.
• docs/user/deployment.md and docs/dev/ci.md are updated in the same commit to reflect the new primary pull source.

Confidence Score: 5/5

Safe to merge — the Docker Hub push is fully additive and the graceful skip when secrets are absent means no existing path is affected.

The change is additive: GHCR publish is unchanged, Docker Hub is skipped when secrets are absent, and the continue-on-error + fail-gate pattern correctly surfaces Hub failures without suppressing the GHCR digest summary. The grep pattern for RepoDigest now handles both the docker.io/-prefixed and bare forms. Docs are updated in the same PR. No pre-existing behaviour is altered.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/publish-image.yml	Adds Docker Hub push step with continue-on-error + fail-gate pattern; digest reporting updated to loop over both registries with correct grep pattern for both RepoDigest prefix forms.
docs/dev/ci.md	Single-line update to the publish-image.yml description to mention Docker Hub and the secret-gate behaviour.
docs/user/deployment.md	Container Deployment section updated to show Docker Hub as the primary pull source with GHCR as the alternate; accurate and consistent with the workflow change.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant GHCR as GHCR
    participant DH as Docker Hub
    participant SUM as Step Summary

    GH->>GH: Validate dispatch tag (if workflow_dispatch)
    GH->>GH: Build release binaries (rust:1-bookworm)
    GH->>GHCR: docker login ghcr.io
    GH->>GHCR: docker build + push image:RELEASE_TAG
    GH->>GHCR: docker push image:latest (push events only)

    alt "DOCKERHUB_* secrets configured"
        GH->>DH: docker login docker.io
        GH->>DH: docker tag + push image:RELEASE_TAG
        GH->>DH: docker push image:latest (push events only)
    else secrets absent
        GH->>GH: skip (exit 0)
    end

    GH->>SUM: Report GHCR pinned digest
    opt DOCKERHUB_USERNAME set
        GH->>SUM: Report Docker Hub pinned digest
    end

    alt "steps.dockerhub.outcome == failure"
        GH->>GH: exit 1 (fail the job)
    end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant GHCR as GHCR
    participant DH as Docker Hub
    participant SUM as Step Summary

    GH->>GH: Validate dispatch tag (if workflow_dispatch)
    GH->>GH: Build release binaries (rust:1-bookworm)
    GH->>GHCR: docker login ghcr.io
    GH->>GHCR: docker build + push image:RELEASE_TAG
    GH->>GHCR: docker push image:latest (push events only)

    alt "DOCKERHUB_* secrets configured"
        GH->>DH: docker login docker.io
        GH->>DH: docker tag + push image:RELEASE_TAG
        GH->>DH: docker push image:latest (push events only)
    else secrets absent
        GH->>GH: skip (exit 0)
    end

    GH->>SUM: Report GHCR pinned digest
    opt DOCKERHUB_USERNAME set
        GH->>SUM: Report Docker Hub pinned digest
    end

    alt "steps.dockerhub.outcome == failure"
        GH->>GH: exit 1 (fail the job)
    end

Loading

Comments Outside Diff (1)

1. .github/workflows/publish-image.yml, line 3-4 (link)

   The top-of-file comment still describes this workflow as publishing only to GHCR. Since Docker Hub is now the primary distribution channel, the comment should reflect that so future readers understand the full intent without scrolling down.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

   

_{Reviews (2): Last reviewed commit: "review fixes: preserve digest summary on..." | Re-trigger Greptile}

[devin-ai-integration]

Devin Review found 1 potential issue.