ci: build every kernel flavour in the matrix

pr-build.yml and publish.yml now iterate the core/rt/hwe/ai flavour
matrix Makefile.eve resolves, instead of building a single implicit
flavour. Each leg builds with its own KERNEL_CONFIG_FLAVOR, so a fragment
change that only affects hwe/ai (deny.fragment, boot.fragment) or only
core/rt (rt.fragment) gets exercised, and the policy checker gate inside
Dockerfile.gcc runs for every flavour on every PR rather than one.

Author: rucoder

.github/workflows/pr-build.yml

@@ -0,0 +1,62 @@
+name: PR Build
+
+on: # yamllint disable-line rule:truthy
+    pull_request:
+        branches:
+            - "gha-test-rebase"
+            - "eve-kernel-*"
+        paths-ignore:
+            - ".github/**"
+
+concurrency:
+    group: pr-build-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    build:
+        strategy:
+            matrix:
+                flavor: [core, rt, hwe, ai]
+            fail-fast: false
+            max-parallel: 3
+
+        runs-on: [runner-xl, X64, Linux]
+
+        steps:
+            - name: Set sanitized branch name
+              id: branch-setter
+              run: |
+                  BRANCH_NAME="${{ github.event.pull_request.head.ref }}"
+                  SAFE_BRANCH="${BRANCH_NAME//\//-}"
+                  echo "SAFE_BRANCH=$SAFE_BRANCH" >> $GITHUB_ENV
+            - name: Checkout PR code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  ref: ${{ github.event.pull_request.head.sha }}
+                  repository: ${{ github.event.pull_request.head.repo.full_name }}
+                  fetch-depth: 1
+
+            - name: Build kernel flavor ${{ matrix.flavor }}
+              run: |
+                  make -f Makefile.eve \
+                    KERNEL_CONFIG_FLAVOR=${{ matrix.flavor }} \
+                    BRANCH=$SAFE_BRANCH \
+                    kernel-gcc
+
+            - name: Clean
+              if: always()
+              run: |
+                  make -f Makefile.eve \
+                    KERNEL_CONFIG_FLAVOR=${{ matrix.flavor }} \
+                    BRANCH=$SAFE_BRANCH \
+                    clean-gcc
+                  if docker ps -q -f name=linuxkit-builder | grep -q .; then
+                      echo "=== BuildKit disk usage before prune ==="
+                      docker exec linuxkit-builder buildctl du | tail -n 2
+                      echo "=== Reclaiming ==="
+                      docker exec linuxkit-builder buildctl prune --keep-storage "${BUILDKIT_KEEP_STORAGE_MB:-32000}" | tail -n 1
+                      echo "=== BuildKit disk usage after prune ==="
+                      docker exec linuxkit-builder buildctl du | tail -n 2
+                  else
+                      echo "linuxkit-builder container not running; skipping BuildKit cleanup."
+                  fi

.github/workflows/publish.yml

@@ -0,0 +1,72 @@
+name: Building and pushing Eve kernel images
+
+on:
+    push:
+        branches:
+            - "gha-test-rebase"
+            - "eve-kernel-*"
+
+concurrency:
+    group: main-build-${{ github.ref }}
+    cancel-in-progress: true
+
+jobs:
+    build:
+        strategy:
+            matrix:
+                flavor: [core, rt, hwe, ai]
+            fail-fast: false
+            max-parallel: 3
+
+        runs-on: [runner-xl, X64, Linux]
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  ref: ${{ github.ref }}
+                  fetch-depth: 1
+
+            - name: Login to Docker Hub (pull)
+              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              with:
+                  username: ${{ secrets.DOCKERHUB_PULL_USER }}
+                  password: ${{ secrets.DOCKERHUB_PULL_TOKEN }}
+
+            - name: Build kernel flavor ${{ matrix.flavor }} from ${{ github.ref_name }}
+              run: |
+                  make -f Makefile.eve \
+                    KERNEL_CONFIG_FLAVOR=${{ matrix.flavor }} \
+                    BRANCH=${{ github.ref_name }} \
+                    kernel-gcc
+
+            - name: Login to Docker Hub (push)
+              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+              with:
+                  username: ${{ secrets.RELEASE_DOCKERHUB_ACCOUNT }}
+                  password: ${{ secrets.RELEASE_DOCKERHUB_TOKEN }}
+
+            - name: Push ${{ matrix.flavor }} from ${{ github.ref_name }}
+              run: |
+                  make -f Makefile.eve \
+                    KERNEL_CONFIG_FLAVOR=${{ matrix.flavor }} \
+                    BRANCH=${{ github.ref_name }} \
+                    push-gcc
+
+            - name: Clean
+              if: always()
+              run: |
+                  make -f Makefile.eve \
+                    KERNEL_CONFIG_FLAVOR=${{ matrix.flavor }} \
+                    BRANCH=${{ github.ref_name }} \
+                    clean-gcc
+                  if docker ps -q -f name=linuxkit-builder | grep -q .; then
+                      echo "=== BuildKit disk usage before prune ==="
+                      docker exec linuxkit-builder buildctl du | tail -n 2
+                      echo "=== Reclaiming ==="
+                      docker exec linuxkit-builder buildctl prune --keep-storage "${BUILDKIT_KEEP_STORAGE_MB:-32000}" | tail -n 1
+                      echo "=== BuildKit disk usage after prune ==="
+                      docker exec linuxkit-builder buildctl du | tail -n 2
+                  else
+                      echo "linuxkit-builder container not running; skipping BuildKit cleanup."
+                  fi