ci: publish docker images to Docker Hub only

Drop GHCR for all first-party images and publish exclusively to
Docker Hub:

- CLI release image -> docker.io/qualcomm/geniex (remove GHCR login +
  push steps in _build-docker.yml; drop the GHCR ref in release.yml and
  the OCI repo_tags in cli/release/linux/BUILD.bazel)
- Toolchain images -> docker.io/qualcomm/geniex-toolchain-{linux,android}
  (_build-toolchain-docker.yml logs in to Docker Hub; _build-sdk.yml
  pulls the toolchain containers from Docker Hub), pinned at v0.0.1
- DockerHub login uses the DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets
- Docs (notes/build.md, sdk/benchmark/README.md, scripts/README.md,
  HANDOFF-android-aar.md, docs/*/run/linux/install.mdx,
  docs/*/resources/troubleshooting.mdx) point at Docker Hub; the
  upstream ghcr.io/snapdragon-toolchain base images are unchanged

Author: RemiliaForever

.github/workflows/_build-docker.yml

@@ -13,15 +13,10 @@ on:
         type: string
         default: ""
       push:
-        description: "Push the image to ghcr.io (release-time only)"
+        description: "Push the image to the registries (release-time only)"
         required: false
         type: boolean
         default: false
-      image:
-        description: "Fully-qualified image reference without tag (release-only)."
-        required: false
-        type: string
-        default: ghcr.io/qualcomm/geniex-cli
       tag:
         description: "Image tag to publish, e.g. v1.2.3 (required when push=true)."
         required: false
@@ -95,17 +90,16 @@ jobs:
           echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
           "${HOME}/.local/bin/crane" version
 
-      - name: Determine image ref
+      - name: Determine image refs
         shell: bash
         env:
           RAW_VERSION: ${{ steps.version.outputs.version }}
-          IMAGE: ${{ inputs.image }}
           TAG: ${{ inputs.tag }}
         run: |
           set -euo pipefail
           bare="${RAW_VERSION#v}"
           dest_tag="${TAG:-$bare}"
-          echo "IMAGE_REF=${IMAGE}:${dest_tag}" >> "$GITHUB_ENV"
+          echo "DOCKERHUB_REF=docker.io/qualcomm/geniex:${dest_tag}" >> "$GITHUB_ENV"
 
       - name: Validate tarball (PR path)
         if: ${{ !inputs.push }}
@@ -117,29 +111,26 @@ jobs:
           file "${tarball}"
           tar -tf "${tarball}" | head -10
 
-      # # Enterprise policy blocks GITHUB_TOKEN from creating org packages,
-      # # so login with GH_PAT (user-scoped, SAML-authorized).
-      # - name: Log in to GHCR (crane)
-      #   if: inputs.push
-      #   shell: bash
-      #   env:
-      #     GHCR_USER: ${{ github.actor }}
-      #     GHCR_TOKEN: ${{ secrets.GH_PAT }}
-      #   run: |
-      #     set -euo pipefail
-      #     echo "${GHCR_TOKEN}" | crane auth login ghcr.io -u "${GHCR_USER}" --password-stdin
-      #
-      # - name: Push image to GHCR
-      #   if: inputs.push
-      #   shell: bash
-      #   env:
-      #     IMAGE: ${{ inputs.image }}
-      #     IMAGE_REF: ${{ env.IMAGE_REF }}
-      #     IS_PRERELEASE: ${{ inputs.is_prerelease }}
-      #   run: |
-      #     set -euo pipefail
-      #     crane push bazel-bin/cli/release/linux/geniex-cli-docker.tar "${IMAGE_REF}"
-      #     # Prereleases must not clobber the floating :latest tag.
-      #     if [[ "${IS_PRERELEASE}" != "true" ]]; then
-      #       crane tag "${IMAGE_REF}" latest
-      #     fi
+      - name: Log in to DockerHub (crane)
+        if: inputs.push
+        shell: bash
+        env:
+          DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          echo "${DOCKERHUB_TOKEN}" | crane auth login docker.io -u "${DOCKERHUB_USER}" --password-stdin
+
+      - name: Push image to DockerHub
+        if: inputs.push
+        shell: bash
+        env:
+          IMAGE_REF: ${{ env.DOCKERHUB_REF }}
+          IS_PRERELEASE: ${{ inputs.is_prerelease }}
+        run: |
+          set -euo pipefail
+          crane push bazel-bin/cli/release/linux/geniex-cli-docker.tar "${IMAGE_REF}"
+          # Prereleases must not clobber the floating :latest tag.
+          if [[ "${IS_PRERELEASE}" != "true" ]]; then
+            crane tag "${IMAGE_REF}" latest
+          fi

.github/workflows/_build-sdk.yml

@@ -40,11 +40,11 @@ jobs:
           - platform: linux-arm64
             runner: ubuntu-latest
             preset: arm64-linux-snapdragon-release
-            container_image: ghcr.io/qualcomm/geniex-toolchain-linux:v0.0.2
+            container_image: docker.io/qualcomm/geniex-toolchain-linux:v0.0.1
           - platform: android-arm64
             runner: ubuntu-latest
             preset: arm64-android-snapdragon-release
-            container_image: ghcr.io/qualcomm/geniex-toolchain-android:v0.0.1
+            container_image: docker.io/qualcomm/geniex-toolchain-android:v0.0.1
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 120
 

.github/workflows/_build-toolchain-docker.yml

@@ -12,8 +12,8 @@ name: Build Toolchain Docker
 #     tag equals the git tag minus the `toolchain-` prefix.
 #
 # Image names:
-#   ghcr.io/qualcomm/geniex-toolchain-linux:<version>
-#   ghcr.io/qualcomm/geniex-toolchain-android:<version>
+#   docker.io/qualcomm/geniex-toolchain-linux:<version>
+#   docker.io/qualcomm/geniex-toolchain-android:<version>
 #
 # We intentionally do NOT publish a :latest tag - _build-sdk.yml pins an
 # exact semantic version so upstream changes cannot silently affect SDK
@@ -41,7 +41,6 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   build:
@@ -54,10 +53,10 @@ jobs:
         include:
           - platform: linux
             dockerfile: .github/docker/toolchain-linux.Dockerfile
-            image: ghcr.io/qualcomm/geniex-toolchain-linux
+            image: docker.io/qualcomm/geniex-toolchain-linux
           - platform: android
             dockerfile: .github/docker/toolchain-android.Dockerfile
-            image: ghcr.io/qualcomm/geniex-toolchain-android
+            image: docker.io/qualcomm/geniex-toolchain-android
 
     steps:
       - name: Checkout source
@@ -105,17 +104,22 @@ jobs:
           steps.meta.outputs.platforms == matrix.platform
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GHCR
+      - name: Log in to DockerHub
         if: >-
           steps.meta.outputs.platforms == 'both' ||
           steps.meta.outputs.platforms == matrix.platform
         uses: docker/login-action@v4
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GH_PAT }}
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push
+      # buildx pushing straight to Docker Hub fails the final blob PUT with
+      # an HTML "400 Bad request"; build to a tarball and push it with crane
+      # instead (same pattern as _build-docker.yml). Use type=docker, not
+      # type=oci: crane's tarball loader needs the manifest.json that only
+      # the docker-archive layout carries.
+      - name: Build image tarball
         if: >-
           steps.meta.outputs.platforms == 'both' ||
           steps.meta.outputs.platforms == matrix.platform
@@ -124,10 +128,41 @@ jobs:
           context: .
           file: ${{ matrix.dockerfile }}
           platforms: linux/amd64
-          push: true
+          push: false
           provenance: false
-          tags: |
-            ${{ matrix.image }}:${{ steps.meta.outputs.version }}
-            ${{ matrix.image }}:sha-${{ github.sha }}
+          outputs: type=docker,dest=${{ runner.temp }}/toolchain-${{ matrix.platform }}.tar
           cache-from: type=gha,scope=toolchain-${{ matrix.platform }}
           cache-to: type=gha,scope=toolchain-${{ matrix.platform }},mode=max
+
+      - name: Install crane (for tarball → registry push)
+        if: >-
+          steps.meta.outputs.platforms == 'both' ||
+          steps.meta.outputs.platforms == matrix.platform
+        shell: bash
+        run: |
+          set -euo pipefail
+          if command -v crane >/dev/null 2>&1; then
+            crane version
+            exit 0
+          fi
+          version="v0.20.3"
+          tmp="$(mktemp -d)"
+          curl -fsSL -o "${tmp}/crane.tgz" \
+            "https://github.com/google/go-containerregistry/releases/download/${version}/go-containerregistry_Linux_x86_64.tar.gz"
+          mkdir -p "${HOME}/.local/bin"
+          tar -xzf "${tmp}/crane.tgz" -C "${HOME}/.local/bin" crane
+          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
+          "${HOME}/.local/bin/crane" version
+
+      - name: Push image with crane
+        if: >-
+          steps.meta.outputs.platforms == 'both' ||
+          steps.meta.outputs.platforms == matrix.platform
+        shell: bash
+        env:
+          TARBALL: ${{ runner.temp }}/toolchain-${{ matrix.platform }}.tar
+          IMAGE: ${{ matrix.image }}
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          set -euo pipefail
+          crane push "${TARBALL}" "${IMAGE}:${VERSION}"

.github/workflows/release.yml

@@ -573,7 +573,6 @@ jobs:
     with:
       version_tag: ${{ needs.resolve-tag.outputs.tag }}
       push: true
-      image: ghcr.io/qualcomm/geniex-cli
       tag: ${{ needs.resolve-tag.outputs.tag }}
       is_prerelease: ${{ needs.resolve-tag.outputs.is_prerelease == 'true' }}
 

HANDOFF-android-aar.md

@@ -61,7 +61,7 @@ docker run --rm -u $(id -u):$(id -g) \
     --workdir /workspace/sdk \
     -e CCACHE_DIR=/workspace/.ccache \
     --platform linux/amd64 \
-    ghcr.io/qualcomm/geniex-toolchain-android:v0.0.1 \
+    docker.io/qualcomm/geniex-toolchain-android:v0.0.1 \
     bash -c 'cmake --preset arm64-android-snapdragon-debug -B build-android . \
       && cmake --build build-android -j \
       && cmake --install build-android --prefix pkg-geniex'

cli/release/linux/BUILD.bazel

@@ -89,7 +89,7 @@ oci_image(
 genrule(
     name = "_repo_tags",
     outs = ["repo_tags.txt"],
-    cmd = "echo ghcr.io/qualcomm/geniex-cli:latest > $@ && echo ghcr.io/qualcomm/geniex-cli:$(VERSION) >> $@",
+    cmd = "echo docker.io/qualcomm/geniex:latest > $@ && echo docker.io/qualcomm/geniex:$(VERSION) >> $@",
     target_compatible_with = ["@platforms//os:linux"],
 )
 

docs/cn/resources/troubleshooting.mdx

@@ -57,13 +57,9 @@ import Feedback from "/snippets/page-feedback.mdx";
   <Accordion title="`docker pull` 报权限错误 / 未授权">
     需要同时满足两点：
 
-    1. **镜像仓库登录。** 登录你拉取所用的仓库：
+    1. **镜像仓库登录。** Docker Hub（`docker.io/qualcomm/geniex`）是公开的，无需登录。Qualcomm Container Registry 则需先登录：
 
        ```bash bash
-       # GitHub Container Registry — PAT (classic) with at least read:packages:
-       export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxx
-       docker login ghcr.io -u <your-github-username> -p "$GITHUB_TOKEN"
-
        # Qualcomm Container Registry:
        docker login docker-registry.qualcomm.com -u '$app' -p GB2S6KXMJXTPV8VHNFNS7Q6LVH75LOOBTLT8D723WUX6PSFZMTX95GIQG4EFWH5C021ONZ5763VI9IDHU96Q7VAZJ2830CLX3NPI6STQOJWRYXLLA2ZYTL1S
        ```

docs/cn/run/linux/install.mdx

@@ -18,10 +18,8 @@ Linux Docker 路径通过 Linux ARM64 容器镜像运行，并支持 NPU 访问
 镜像同时发布到两个仓库——选择你有权限的一个，设置 `IMAGE` 后再拉取：
 
 ```bash bash
-# Option A — GitHub Container Registry (PAT with read:packages):
-export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxx
-docker login ghcr.io -u <your-github-username> -p "$GITHUB_TOKEN"
-IMAGE=ghcr.io/qualcomm/geniex-cli:latest
+# Option A — Docker Hub (公开，无需登录):
+IMAGE=docker.io/qualcomm/geniex:latest
 
 # Option B — Qualcomm Container Registry:
 docker login docker-registry.qualcomm.com -u '<username>' -p '<token>'

docs/en/resources/troubleshooting.mdx

@@ -57,13 +57,9 @@ import Feedback from "/snippets/page-feedback.mdx";
   <Accordion title="`docker pull` fails with permission / unauthorized">
     Two separate things have to be right:
 
-    1. **Registry login.** Log in to whichever registry you pull from:
+    1. **Registry login.** Docker Hub (`docker.io/qualcomm/geniex`) is public and needs no login. For the Qualcomm Container Registry, log in first:
 
        ```bash bash
-       # GitHub Container Registry — PAT (classic) with at least read:packages:
-       export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxx
-       docker login ghcr.io -u <your-github-username> -p "$GITHUB_TOKEN"
-
        # Qualcomm Container Registry:
        docker login docker-registry.qualcomm.com -u '$app' -p GB2S6KXMJXTPV8VHNFNS7Q6LVH75LOOBTLT8D723WUX6PSFZMTX95GIQG4EFWH5C021ONZ5763VI9IDHU96Q7VAZJ2830CLX3NPI6STQOJWRYXLLA2ZYTL1S
        ```

docs/en/run/linux/install.mdx

@@ -18,10 +18,8 @@ The Linux Docker path runs through a container image built for Linux ARM64 with
 The image is published to two registries — pick whichever you have access to and set `IMAGE` accordingly, then pull:
 
 ```bash bash
-# Option A — GitHub Container Registry (PAT with read:packages):
-export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxx
-docker login ghcr.io -u <your-github-username> -p "$GITHUB_TOKEN"
-IMAGE=ghcr.io/qualcomm/geniex-cli:latest
+# Option A — Docker Hub (public, no login required):
+IMAGE=docker.io/qualcomm/geniex:latest
 
 # Option B — Qualcomm Container Registry:
 docker login docker-registry.qualcomm.com -u '<username>' -p '<token>'