ci(docker): add build workflow for xen-riscv64-trixie image

[gounthar]

Adds a GitHub Actions workflow to build the docker/riscv/trixie image. @baptleduc suggested opening this as a dedicated PR upstream (split out from baptleduc#1, which I closed).

• On pull requests touching docker/riscv/trixie/**: builds amd64, no push (validates the Dockerfile still builds).
• On pushes to main touching the same path: builds and pushes :latest.

amd64 only for now. arm64 isn't viable until the AIA + fakedevice-patched QEMU is built for arm64 (it only exists as the amd64 GitLab artifact today), so I left it out rather than ship a broken arm64 image.

Prerequisite: the workflow expects DOCKERHUB_USERNAME / DOCKERHUB_TOKEN repo secrets for the push step. If you'd prefer a different registry/namespace, or want the push gated to tags / workflow_dispatch only, happy to adjust.

[baptleduc]

Thanks for opening a dedicated PR.

I would suggest pushing images only on specific tags (e.g. v1.0.1-xen-riscv64). This is already what I do in my linux-xen-riscvrepository and would avoid publishing a new image for every unrelated change merged into this repo.

Moreover, since this repository hosts multiple H&K development tools, not every merge should trigger a Docker image release.

As for the registry, GitHub Container Registry (GHCR) could be a better fit, as it would keep both the source code and container images in the same place. What do you think?

[gounthar]

@baptleduc Good calls, both done. The publish step now triggers only on tags matching v[0-9]+.[0-9]+.[0-9]+-xen-riscv64, so a routine merge into this repo never publishes; only a deliberate tag does. I also moved the registry to GHCR (ghcr.io/<owner>/xen-riscv64-trixie), which drops the Docker Hub secrets since it authenticates with the built-in GITHUB_TOKEN, and keeps the image next to the source like you suggested. PRs still run an amd64 build-only check. Happy to tweak the tag pattern if you'd rather it match what you use elsewhere.

[baptleduc]

@baptleduc Good calls, both done. The publish step now triggers only on tags matching v[0-9]+.[0-9]+.[0-9]+-xen-riscv64,

Maybe for consistency with the image's name, the tag pattern should be instead v[0-9]+.[0-9]+.[0-9]+-xen-riscv64-trixie

[baptleduc]

Suggested change

	- 'v[0-9]+.[0-9]+.[0-9]+-xen-riscv64'
	- 'v[0-9]+.[0-9]+.[0-9]+-xen-riscv64-trixie'

[gounthar]

@baptleduc Done. The publish trigger now matches v[0-9]+.[0-9]+.[0-9]+-xen-riscv64-trixie, so the tag lines up with the image name.

[baptleduc]

Thanks, Igtm

[baptleduc]

One last thing @gounthar, could you please fix the CI errors?

[gounthar]

Done, pushed eff343d. The zizmor failures were all the pin-to-SHA policy, so I pinned checkout, setup-buildx, login and build-push to commit SHAs and set persist-credentials: false on checkout (the artipacked one). The run is stuck in "action_required" though. Could you approve the workflow so zizmor re-runs? Should be green once it does.

[baptleduc]

Done, pushed eff343d. The zizmor failures were all the pin-to-SHA policy, so I pinned checkout, setup-buildx, login and build-push to commit SHAs and set persist-credentials: false on checkout (the artipacked one). The run is stuck in "action_required" though. Could you approve the workflow so zizmor re-runs? Should be green once it does.

The CI is green now thanks! One last things that is required, your commits should be sign...