[abice]

Summary

Build and publish the LTK-maintained coverage image to ghcr.io/rewardstyle/cov-diff instead of the AWS/ECR approach in PR #2. This provides a prebuilt image for a subsequent consumer migration that avoids rebuilding Docker on every coverage check.

Jira: https://rewardstyle.atlassian.net/browse/BRE-5080 (BRE-4026, 1 point).

Changes

• Build and smoke-test the image in hosted CI on pull requests, without publishing.
• Publish the tested image on pushes to main with full commit SHA and main tags, using job-scoped GITHUB_TOKEN package permissions.
• Link the image to its source repository with OCI labels.
• Include the shared mirror and CI repairs from parallel PR [BRE-5079] Avoid Docker Hub throttling with the GCR mirror #4 so this PR can validate independently against main.
• Document publication and the later consumer migration.

Testing

• All workflow YAML parsed successfully.
• git diff --check passed.
• The shared mirror and CI repairs passed hosted checks in PR [BRE-5079] Avoid Docker Hub throttling with the GCR mirror #4.
• Image build and smoke testing are reserved for hosted CI; no full local Docker build was run because of disk pressure.
• Hosted image build and smoke test passed on head dd24bd4b4b89888c49744f28f45b7b1a34d32c22: https://github.com/rewardStyle/cov-diff/actions/runs/37993687348. Registry login and publication were skipped on the PR as intended.

Remaining steps

• This draft PR does not publish an image. Publication starts after merge and a successful main-branch workflow.
• GHCR packages default to private. Anonymous pulls require an explicit package visibility decision after publication; this PR does not change visibility.
• The existing Dockerfile-based action continues to build per consumer run until it is switched to the published image, pinned by digest.
• KTL review is unavailable because this repository has no KTL workflow configured.

[github-actions]

Coverage on new code: 100%