ci(ecr): publish seitask-runner image on push to main (PR 8)

[bdchatham]

Extends .github/workflows/ecr.yml to publish the seitask-runner image alongside the controller on every push to main and on workflow_dispatch.

Workstream

Follow-up to the SeiNodeTask MVP workstream:

• PRs 1–6 + hotfix fix(crd): add seinodetasks to config/crd/kustomization.yaml #287 + PR 7 (feat(scenarios): ConfigMap ownerReference + Workflow name templating (PR 7) #290): MVP shipped and runnable
• PR 8 (this PR): runner image release pipeline
• After this merges, scenarios/major-upgrade.yaml's "runner image not yet auto-published" prerequisite goes away — operators can pin to <registry>/sei/seitask-runner:<sha> for any merge to main.

Change

One additional docker/build-push-action@v6 step in the existing publish job. Reuses:

• Same OIDC role assumption
• Same ECR login
• Same buildx setup
• Same shared build-cache (sei/build-cache:shared) — both images contribute layers to one cache target

The only difference from the controller step: file: runner/Dockerfile and the seitask-runner repo tag.

- name: Build and push seitask-runner image
  uses: docker/build-push-action@v6
  with:
    context: .
    file: runner/Dockerfile
    push: true
    platforms: linux/amd64
    tags: ${{ steps.ecr-login.outputs.registry }}/sei/seitask-runner:${{ inputs.tag || github.sha }}
    cache-from: type=registry,ref=${{ steps.ecr-login.outputs.registry }}/sei/build-cache:shared
    cache-to: type=registry,ref=${{ steps.ecr-login.outputs.registry }}/sei/build-cache:shared,mode=max

Also gave the existing controller step an explicit name: for symmetry with the new step.

Tag synchronization

Both images get the same tag per run (<short-sha> or the tag workflow_dispatch input). This means the controller image and the runner image at any given commit are addressable as one logical release pair. If you pin the controller to :abc1234, you pin the runner to :abc1234 too.

Prerequisite

The ECR repository sei/seitask-runner must exist in account 189176372795 before the workflow runs. This is a one-time manual setup; this action does not auto-create repositories. Plan to file the runbook note in the platform docs.

Test plan

• python3 -c 'import yaml; yaml.safe_load(...)' parses cleanly
• After merge, watch the next push-to-main run: both build/push steps complete green
• Confirm the runner image appears in ECR at sei/seitask-runner:<sha> (requires the repo to be pre-created)
• Once available, update scenarios/README.md Prerequisites item 4 to point to the auto-published image (small follow-up after the first successful publish run)

🤖 Generated with Claude Code

[cursor]

You have used all Bugbot PR reviews included in your free trial for your GitHub account on this workspace.

To continue using Bugbot reviews, enable Bugbot for your team in the Cursor dashboard.