fix(ci): publish arm64 nightly images and remove superseded workflow

[jdye64]

Summary

• Removes docker-nightly-publish.yml — this workflow only built linux/amd64 yet fired on the same cron schedule (30 23 * * *) as scheduled-nightly.yml. Both pushed to the same date tag, so whichever landed last won; the old workflow frequently overwrote the nightly manifest with an amd64-only image. scheduled-nightly.yml is a strict superset and replaces it entirely.
• Fixes the buildx builder conflict in scheduled-nightly.yml — the job called docker buildx create --use after ./.github/actions/setup-docker-buildx had already created and configured a QEMU-enabled builder. The second create replaced that builder with an unconfigured one. Replaced the raw shell docker buildx build call with docker/build-push-action@v6 (matching the release workflow) so the action's builder is honoured.
• Stops leaking HF_ACCESS_TOKEN into the build cache — the token was passed as --build-arg, embedding it in image layers and the GHA cache. Switched to --secret / secret-files, consistent with every other workflow in this repo.

Test plan

• Manually trigger scheduled-nightly.yml via workflow_dispatch and confirm the published manifest includes both linux/amd64 and linux/arm64 (docker buildx imagetools inspect <tag>)
• Confirm docker-nightly-publish.yml no longer appears in the Actions tab

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR consolidates nightly image publication into scheduled-nightly.yml, removes the competing amd64-only workflow, and switches the remaining build to the configured Buildx builder with BuildKit secret handling.

• Deletes the duplicate nightly publisher that could overwrite the multi-platform manifest.
• Publishes linux/amd64 and linux/arm64 images through docker/build-push-action.
• Replaces the Hugging Face token build argument with a temporary BuildKit secret file and adds unconditional cleanup.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code failure remaining after checking the workflow replacement and secret-handling paths.

The retained workflow covers scheduled and manual multi-platform publication, while the token file is excluded from the build context and cleaned up even when the build fails.

Important Files Changed

Filename	Overview
.github/workflows/docker-nightly-publish.yml	Removes the duplicate amd64-only publisher whose shared schedule and tag could overwrite the multi-platform nightly manifest.
.github/workflows/scheduled-nightly.yml	Uses the configured Buildx builder to publish both architectures and replaces the token build argument with an excluded, cleaned-up secret file.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Trigger[Schedule or manual dispatch] --> Setup[Checkout, QEMU, and configured Buildx]
  Setup --> Token[Create temporary HF token file when configured]
  Token --> Build[Build amd64 and arm64 service images]
  Build --> Push[Push one multi-platform nightly tag]
  Push --> Cleanup[Remove temporary token file]
  Build -->|failure| Cleanup

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): publish arm64 nightly images an..." | Re-trigger Greptile}