feat :Testing workflow to push images

[arekay-nv]

What does this PR do?

Adds a reproducible way to build and publish the endpoints client image to
ghcr.io/mlcommons/endpoints:

• scripts/push_docker_image.sh — builds scripts/Dockerfile.dev at a chosen
  git ref via docker buildx and pushes it, tagged with both the short commit SHA
  and the ref name so consumers can pin either.
• .github/workflows/publish-image.yml — a manually-triggered
  (workflow_dispatch) workflow that runs the script, so a publish can be kicked
  off from the Actions tab against any selected branch/tag/SHA without a local
  Docker setup.

The workflow reuses the script (single source of truth for the tag scheme) rather
than duplicating build logic.

Behavior & design

Aspect	Choice
Default platform	linux/amd64 (what benchmark clients run on); multi-arch is one flag/input away
Multi-arch	--multi-arch / linux/amd64,linux/arm64 publishes a manifest list usable on x86 and arm
Tags	:<short-sha> + :<sanitized-ref>
Builder	self-provisions a docker-container buildx builder (the default docker driver can neither --push nor build multi-platform)
Auth	script logs in via GHCR_USER/GHCR_TOKEN if set, else assumes docker login; workflow uses github.actor + the automatic GITHUB_TOKEN
Safety	refuses to publish a :$SHA tag from a dirty tree (--allow-dirty to override); optional ref checkout is restored on exit
PROVISION_DSR1	passthrough build-arg (default = Dockerfile default 1); set 0 for a lean client-only image

CI prerequisites (one-time, outside this PR)

• Workflow must land on the default branch before the "Run workflow" button appears.
• permissions: packages: write is set in the workflow; the org must allow the
  GITHUB_TOKEN to write packages, and the endpoints package must grant this repo
  Write access (Package → Manage Actions access). Usually automatic since the
  package lives under this repo's org.

Note: GITHUB_TOKEN authenticates as github-actions[bot] (scoped to this repo);
username: github.actor only sets the login name. For a push attributed to a
specific account, supply that account's PAT as a secret instead.

Validation

• Multi-arch dry build (--multi-arch --no-push): both linux/amd64 (emulated)
  and linux/arm64 (native) compiled all stages, exit 0.
• Script is clean under macOS bash 3.2.57 and bash -n; the empty-array
  expansion and tag sanitizer were unit-checked; the dirty-tree guard was exercised
  across push/dry/allow-dirty/clean/checked-out cases.
• Reviewed via a two-model council (Codex + Claude); all findings fixed: detached-HEAD
  ref resolution, Docker-tag sanitization beyond /, bash-3.2 empty-array crash, and
  the dirty-tree publish guard. Workflow security posture confirmed (inputs passed via
  env: not inline ${{ }}, actions pinned to SHAs, minimal contents:read +
  packages:write).

Type of change

• Bug fix
• New feature
• Documentation update
• Refactor/cleanup

Related issues

Testing

• Tests added/updated
• All tests pass locally
• Manual testing completed

Checklist

• Code follows project style
• Pre-commit hooks pass
• Documentation updated (if needed)

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[gemini-code-assist]

Code Review

This pull request introduces a new bash script, scripts/push_docker_image.sh, designed to build and push the endpoints client Docker image to a registry with support for multi-platform builds, custom git refs, and registry authentication. The review feedback highlights two important shell scripting improvements: using printf instead of echo to safely pipe the registry login token, and properly quoting the BUILD_ARGS array expansion to prevent word splitting.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Using echo to pipe sensitive tokens or arbitrary strings can lead to unexpected behavior if the token starts with a hyphen (e.g., -n or -e), as echo may interpret it as an option. It is safer and more robust to use printf '%s\n' instead.

Suggested change

	echo "$LOGIN_TOKEN" | docker login "$REGISTRY_HOST" -u "${LOGIN_USER:-x-access-token}" --password-stdin
	printf '%s\n' "$LOGIN_TOKEN" | docker login "$REGISTRY_HOST" -u "${LOGIN_USER:-x-access-token}" --password-stdin

[gemini-code-assist]

The array expansion ${BUILD_ARGS[@]+"${BUILD_ARGS[@]}"} is missing outer double quotes. Without outer double quotes, any array elements containing spaces or glob characters will undergo word splitting and pathname expansion when expanded. To safely preserve spaces within array elements while maintaining compatibility with set -u in older Bash versions, wrap the entire expansion in double quotes.

Suggested change

	${BUILD_ARGS[@]+"${BUILD_ARGS[@]}"} \
	"${BUILD_ARGS[@]+"${BUILD_ARGS[@]}"}" \