patch image publish workflow

Signed-off-by: Zhengyuan Su <su.zhengyuan@u.nus.edu>

Author: timzsu

.github/workflows/image-publish.yml

@@ -26,8 +26,67 @@ env:
   IMAGE_NAME: mlsys-io/lumilake_server
 
 jobs:
+  build-pr:
+    name: Build image
+    if: github.event_name == 'pull_request'
+    runs-on: [self-hosted, docker]
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435  # v3.11.1
+
+      - name: Compute image tags
+        id: tags
+        env:
+          SHA: ${{ github.sha }}
+        run: |
+          set -eu
+          short_sha="${SHA::7}"
+          echo "tags=${REGISTRY}/${IMAGE_NAME}:pr-${short_sha}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
+        with:
+          version: "0.11.8"
+          python-version: "3.12"
+          # No uv cache restore in a publishing workflow (cache-poisoning).
+          enable-cache: false
+
+      - name: Sync server requirements from uv.lock
+        run: uv run --frozen scripts/dev/sync_requirements.py --write
+
+      - name: Verify lockfile sync was a no-op
+        run: |
+          if ! git diff --quiet src/lumilake_server/requirements.txt; then
+            echo "src/lumilake_server/requirements.txt drifted from uv.lock." >&2
+            echo "Run: uv run scripts/dev/sync_requirements.py --write" >&2
+            git --no-pager diff src/lumilake_server/requirements.txt
+            exit 1
+          fi
+
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0  # v6.17.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: false
+          tags: ${{ steps.tags.outputs.tags }}
+          provenance: false
+          build-args: |
+            BUILD_VERSION=${{ github.ref_name }}
+            BUILD_REF=${{ github.sha }}
+            BUILD_CREATED=${{ github.event.repository.updated_at }}
+
   build-and-push:
-    name: Build multi-arch image
+    name: Build and push multi-arch image
+    if: github.event_name == 'push'
     runs-on: [self-hosted, docker]
     permissions:
       contents: read
@@ -39,13 +98,12 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@5306bad0baa6b616b9934712d4b9bc20069df9bf  # v3.6.0
+        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392  # v3.6.0
 
       - name: Set up Buildx
         uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435  # v3.11.1
 
       - name: Log in to GHCR
-        if: github.event_name != 'pull_request'
         uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1  # v3.5.0
         with:
           registry: ${{ env.REGISTRY }}
@@ -58,18 +116,15 @@ jobs:
           REF_NAME: ${{ github.ref_name }}
           REF_TYPE: ${{ github.ref_type }}
           SHA: ${{ github.sha }}
-          EVENT_NAME: ${{ github.event_name }}
         run: |
           set -eu
           short_sha="${SHA::7}"
           tags=("${REGISTRY}/${IMAGE_NAME}:${short_sha}")
           # :latest is owned by release-images.yml (gated on env approval).
-          if [[ "${EVENT_NAME}" == "push" ]]; then
-            if [[ "${REF_TYPE}" == "tag" && "${REF_NAME}" == v* ]]; then
-              tags+=("${REGISTRY}/${IMAGE_NAME}:${REF_NAME}")
-            elif [[ "${REF_NAME}" == "main" ]]; then
-              tags+=("${REGISTRY}/${IMAGE_NAME}:dev")
-            fi
+          if [[ "${REF_TYPE}" == "tag" && "${REF_NAME}" == v* ]]; then
+            tags+=("${REGISTRY}/${IMAGE_NAME}:${REF_NAME}")
+          elif [[ "${REF_NAME}" == "main" ]]; then
+            tags+=("${REGISTRY}/${IMAGE_NAME}:dev")
           fi
           ( IFS=,; echo "tags=${tags[*]}" ) >> "$GITHUB_OUTPUT"
 
@@ -100,7 +155,7 @@ jobs:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.tags.outputs.tags }}
           provenance: false
           build-args: |
@@ -109,7 +164,6 @@ jobs:
             BUILD_CREATED=${{ github.event.repository.updated_at }}
 
       - name: Smoke-test pushed image
-        if: github.event_name != 'pull_request'
         env:
           SHA: ${{ github.sha }}
         run: |