IT-3421: Build just before pushing image

[brucehoff]

Previously the workflow (1) built the Docker image, (2) saved as a tar-blob, (3) scanned (using Trivy), (4) reload the tar-blob as an image and pushed the image to ghcr.io. However it turns out that when a tar-blob is reloaded, crucial metadata about the image is lost. One discussion on the topic is here.. The fix is to build the image just before pushing (with no save/load in between). Building the image twice makes the workflow less efficient but it works.

[ConsoleCatzirl]

same comment as Sage-Bionetworks-IT/notebook-reverse-proxy#10

I'm fine with building twice, but there are also docker save and docker load commands if you want to try them.

[brucehoff]

same comment as Sage-Bionetworks-IT/notebook-reverse-proxy#10

I'm fine with building twice, but there are also docker save and docker load commands if you want to try them.

Thanks for this suggestion. While docker save / docker load will, indeed, solve the immediate problem of losing image metadata, the commands introduce a new problem: Since the GitHub workflow builds multiple tags, and since save and load are tag-specific, we'd have to create a matrix of parallel jobs to save/load each tag. It's far easier simply to build the image twice.