Improve GHCR asset publishing and expand trigger events to include pull_request

[desrosj]

What?

Expands the publish-to-container-registry job in build-plugin-zip.yml to run on more event types, and publishes a second, mutable tag alongside the existing SHA tag.

Previously the job ran only on push to trunk, release/**, and wp/**. It now also runs on:

• workflow_dispatch
• pull_request — only when the head branch lives in WordPress/gutenberg (fork PRs are explicitly excluded via github.event.pull_request.head.repo.full_name == github.repository)

Every successful publish now produces two tags pointing at the same OCI manifest (added via oras tag, so no duplicated blob storage):

Trigger	SHA tag (immutable)	Mutable tag
push to trunk	<github.sha>	trunk
push to release/X.Y	<github.sha>	release-X.Y
push to wp/X.Y	<github.sha>	wp-X.Y
workflow_dispatch	<github.sha>	matches branch
pull_request (internal branch)	<pull_request.head.sha>	pr-<N>

The SHA tag scheme is unchanged so that https://github.com/WordPress/wordpress-develop/ and any other downstream that pins to gutenberg.sha continues to work without modification.

See WordPress/wordpress-develop#11809 as a companion PR that would add support for this in wordpress-develop.

Why?

There is currently no way to test unmerged changes in the Gutenberg repository in the context of https://github.com/WordPress/wordpress-develop/.

By publishing assets for pull requests, this is now possible. The mutable tag also gives contributors a stable "latest of stream" reference that doesn't require frequent updating of the pinned SHA on every new build. This is especially useful when working on a pull request to ensure the latest changes are present.

How?

This adjusts the workflow logic and makes changes to how the image is tagged through ORAS.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Opus 4.7
Used for: Analysis and initial draft patch.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: desrosj <desrosj@git.wordpress.org>
Co-authored-by: westonruter <westonruter@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[westonruter]

So would the MUTABLE_TAG be usable in gutenberg.sha in the wordpress-develop package.json?

[desrosj]

That's right! I've created WordPress/wordpress-develop#11809 to show how I picture this working from a consumer standpoint.

[Copilot]

Pull request overview

Updates the build-plugin-zip.yml workflow to publish the wordpress-develop build artifact to GHCR for additional event types (including internal PRs), and to add a mutable “stream” tag alongside the existing immutable SHA tag so downstream consumers can reference “latest for X”.

Changes:

• Expand publish-to-container-registry to run on workflow_dispatch and internal pull_request events (excluding fork PRs).
• Use ORAS to push the artifact under a SHA-based tag and then add a second mutable tag derived from branch name or PR number.
• Record a SOURCE_SHA value in .gutenberg-hash and OCI annotations for PR runs (using the PR head SHA instead of the ephemeral merge SHA).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[westonruter]

Thank you so much for this!