ci: publish release images to quay.io

In the release podvm publish worfklow  we mirror the ghcr image
to quay.

Signed-off-by: Magnus Kulke <magnuskulke@microsoft.com>

Author: mkulke

.github/workflows/podvm_publish.yaml

@@ -8,7 +8,7 @@ on:
   workflow_dispatch:
     inputs:
       registry:
-        description: 'Container registry to push images to (e.g., quay.io/your-username)'
+        description: 'Alternative container registry to push images to (e.g., quay.io/your-username)'
         required: false
         type: string
         default: ''
@@ -25,13 +25,20 @@ on:
         type: string
         default: ''
       registry:
-        description: 'Container registry to push images to (e.g., quay.io/your-username)'
+        description: 'Alternative container registry to push images to (e.g., quay.io/your-username)'
         required: false
         type: string
         default: ''
+    secrets:
+      QUAY_PASSWORD:
+        required: false
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || inputs.git_ref }}
+  cancel-in-progress: true
+
 jobs:
   podvm:
     uses: ./.github/workflows/podvm_mkosi.yaml
@@ -50,3 +57,35 @@ jobs:
       image_tag: ${{ inputs.image_tag || github.sha }}
       arch: ${{ matrix.arch}}
       debug: false
+
+  push-to-quay:
+    name: Push podvm image to quay.io
+    permissions:
+      packages: read # Required to copy container images
+    needs: podvm
+    if: ${{ startsWith(inputs.registry, 'quay.io') }}
+    runs-on: ubuntu-latest
+    steps:
+    - name: Login to ghcr.io container registry
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Login to quay.io container registry
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      with:
+        registry: quay.io
+        username: ${{ vars.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_PASSWORD }}
+
+    - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+
+    - name: Push podvm image to quay.io
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        GHCR_IMAGE: ${{ needs.podvm.outputs.qcow2_oras_image }}
+      run: |
+        quay_image="${REGISTRY}/$(basename "$GHCR_IMAGE")"
+        oras cp "$GHCR_IMAGE" "$quay_image"

.github/workflows/release.yaml

@@ -44,6 +44,8 @@ jobs:
       id-token: write          # Required for attestation signing
       attestations: write      # Required for persisting attestations
       artifact-metadata: write # Required by podvm_mkosi.yaml to write attestation metadata
+    secrets:
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
 
   podvm-byom-binaries:
     needs: podvm-images  # Depends on podvm-binaries-ubuntu-{arch} images