Docker C extraction: retag tested container as latest and use latest hosted image in workflows

.github/workflows/c.yml

@@ -8,6 +8,11 @@ on:
   workflow_dispatch:
   merge_group:
 
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}-c
+  VERSION_TAG: latest
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -28,6 +33,7 @@ jobs:
     outputs:
       # only run if files in `.docker/c/` unchanged
       should-run: ${{ steps.changes.outputs.docker-c == 'false' }}
+      image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION_TAG }}
 
   report-status-tests:
     runs-on: ubuntu-latest
@@ -56,7 +62,8 @@ jobs:
     needs: [setup]
     if: ${{ needs.setup.outputs.should-run == 'true' }}
     runs-on: ubuntu-latest
-    container: franziskus/libcrux-c:latest
+    container:
+      image: ${{ needs.setup.outputs.image }}
     defaults:
       run:
         working-directory: libcrux-ml-kem
@@ -80,7 +87,8 @@ jobs:
     needs: [setup]
     if: ${{ needs.setup.outputs.should-run == 'true' }}
     runs-on: ubuntu-latest
-    container: franziskus/libcrux-c:latest
+    container:
+      image: ${{ needs.setup.outputs.image }}
     defaults:
       run:
         working-directory: libcrux-ml-kem
@@ -105,7 +113,8 @@ jobs:
     needs: [setup]
     if: ${{ needs.setup.outputs.should-run == 'true' }}
     runs-on: ubuntu-latest
-    container: franziskus/libcrux-c:latest
+    container:
+      image: ${{ needs.setup.outputs.image }}
     defaults:
       run:
         working-directory: libcrux-ml-dsa

.github/workflows/docker-c-latest.yml

@@ -0,0 +1,57 @@
+name: Publish latest Docker C extraction container
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: ['main']
+    paths: ['.docker/c/**']
+    types:
+      - closed
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}-c
+  SOURCE_TAG: unstable
+  TARGET_TAG: latest
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  setup:
+    # Only run if PR merged
+    if: ${{ github.event.pull_request.merged == true }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup tag names
+        run: echo "Setting up tag names..."
+    outputs:
+      source_image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.SOURCE_TAG }}
+      target_image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TARGET_TAG }}
+
+
+  publish:
+    needs: [setup]
+    runs-on: ubuntu-latest
+
+    # We need write access to packages
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Retag and push Docker image
+        id: push
+        run: |
+            docker pull ${{ needs.setup.outputs.source_image }}
+            docker tag ${{ needs.setup.outputs.source_image }} ${{ needs.setup.outputs.target_image }}
+            docker push ${{ needs.setup.outputs.target_image }}