From 78cc44f4dcb0408fa02711d17a1649d5c88170ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20G=C3=BCttler?= <thomas.guettler@syself.com>
Date: Fri, 24 Apr 2026 09:41:11 +0200
Subject: [PATCH 1/3] create container images in CI.

---
 .github/workflows/release.yaml | 72 ++++++++++++++++++++++++++++++++++
 Makefile                       |  4 ++
 2 files changed, 76 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d1a0e5041b08..1fb80fecea80 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,14 +4,18 @@ on:
   push:
     branches:
       - main
+    tags:
+      - 'v*.*.*'
     paths:
       - 'CHANGELOG/*.md'
 
 permissions:
   contents: write # Allow to push a tag, create a release branch and publish a draft release.
+  packages: write
 
 jobs:
   push_release_tags:
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     outputs:
       release_tag: ${{ steps.release-version.outputs.release_version }}
@@ -80,6 +84,7 @@ jobs:
           echo "Created tags $RELEASE_VERSION and test/${RELEASE_VERSION}"
   release:
     name: create draft release
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     needs: push_release_tags
     steps:
@@ -112,3 +117,70 @@ jobs:
           files: out/*
           body_path: ${{ env.RELEASE_TAG }}.md
           tag_name: ${{ env.RELEASE_TAG }}
+  push_release_images:
+    name: build and push ${{ matrix.arch }} images
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [amd64, arm, arm64, ppc64le, s390x]
+    env:
+      REGISTRY: ghcr.io/syself/cluster-api-prod
+      ALL_DOCKER_BUILD: core
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: Build images
+        run: |
+          make REGISTRY="${REGISTRY}" TAG="${GITHUB_REF_NAME}" ARCH="${{ matrix.arch }}" ALL_DOCKER_BUILD="${ALL_DOCKER_BUILD}" docker-build
+      - name: Log in to ghcr.io
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # tag=v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Push images
+        run: |
+          make REGISTRY="${REGISTRY}" TAG="${GITHUB_REF_NAME}" ARCH="${{ matrix.arch }}" ALL_DOCKER_BUILD="${ALL_DOCKER_BUILD}" docker-push
+  push_release_image_manifests:
+    name: push multi-arch manifests
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: push_release_images
+    env:
+      REGISTRY: ghcr.io/syself/cluster-api-prod
+      ALL_DOCKER_BUILD: core
+      ALL_ARCH: amd64 arm arm64 ppc64le s390x
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: Log in to ghcr.io
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # tag=v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: Push multi-arch manifests
+        run: |
+          make REGISTRY="${REGISTRY}" TAG="${GITHUB_REF_NAME}" ALL_ARCH="${ALL_ARCH}" ALL_DOCKER_BUILD="${ALL_DOCKER_BUILD}" docker-push-manifests
diff --git a/Makefile b/Makefile
index 3178843912ea..ca4e6351e161 100644
--- a/Makefile
+++ b/Makefile
@@ -1246,6 +1246,10 @@ docker-image-verify: ## Verifies all built images to contain the correct binary
 
 .PHONY: docker-push-all
 docker-push-all: $(addprefix docker-push-,$(ALL_ARCH))  ## Push the docker images to be included in the release for all architectures + related multiarch manifests
+	$(MAKE) ALL_ARCH="$(ALL_ARCH)" docker-push-manifests
+
+.PHONY: docker-push-manifests
+docker-push-manifests: ## Push only the related multiarch manifests for all docker images
 	$(MAKE) ALL_ARCH="$(ALL_ARCH)" $(addprefix docker-push-manifest-,$(ALL_DOCKER_BUILD))
 
 docker-push-%:

From eb8f4d74b57ea998d202cfbe9673afcbddf2831a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20G=C3=BCttler?= <thomas.guettler@syself.com>
Date: Fri, 24 Apr 2026 09:58:37 +0200
Subject: [PATCH 2/3] Fix container image push failure in CI

- Changed REGISTRY from ghcr.io/syself/cluster-api-prod to ghcr.io/syself
- This fixes the docker push failure by using the standard GHCR image naming format
- Images will now be pushed as ghcr.io/syself/cluster-api-controller-amd64:v1.11.6-syself.1.2
---
 .github/workflows/release.yaml  | 4 ++--
 CHANGELOG/v1.11.6-syself.1.2.md | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 CHANGELOG/v1.11.6-syself.1.2.md

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1fb80fecea80..4e90c6bd7aed 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -127,7 +127,7 @@ jobs:
       matrix:
         arch: [amd64, arm, arm64, ppc64le, s390x]
     env:
-      REGISTRY: ghcr.io/syself/cluster-api-prod
+      REGISTRY: ghcr.io/syself
       ALL_DOCKER_BUILD: core
     steps:
       - name: Checkout code
@@ -160,7 +160,7 @@ jobs:
     timeout-minutes: 30
     needs: push_release_images
     env:
-      REGISTRY: ghcr.io/syself/cluster-api-prod
+      REGISTRY: ghcr.io/syself
       ALL_DOCKER_BUILD: core
       ALL_ARCH: amd64 arm arm64 ppc64le s390x
     steps:
diff --git a/CHANGELOG/v1.11.6-syself.1.2.md b/CHANGELOG/v1.11.6-syself.1.2.md
new file mode 100644
index 000000000000..292c8b4594f3
--- /dev/null
+++ b/CHANGELOG/v1.11.6-syself.1.2.md
@@ -0,0 +1,7 @@
+# Changelog for v1.11.6-syself.1.2
+
+## Changes by Kind
+
+### Bug or Regression
+
+- Fixed GitHub Actions workflow registry path issue for container image builds. Changed REGISTRY from `ghcr.io/syself/cluster-api-prod` to `ghcr.io/syself` to use the standard GHCR image naming format. This resolves the container push failures in the release workflow.

From 7d6ad50ff73475f0cb762eca75cc253ce858723b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20G=C3=BCttler?= <thomas.guettler@syself.com>
Date: Fri, 24 Apr 2026 10:08:14 +0200
Subject: [PATCH 3/3] not needed.

---
 CHANGELOG/v1.11.6-syself.1.2.md | 7 -------
 1 file changed, 7 deletions(-)
 delete mode 100644 CHANGELOG/v1.11.6-syself.1.2.md

diff --git a/CHANGELOG/v1.11.6-syself.1.2.md b/CHANGELOG/v1.11.6-syself.1.2.md
deleted file mode 100644
index 292c8b4594f3..000000000000
--- a/CHANGELOG/v1.11.6-syself.1.2.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Changelog for v1.11.6-syself.1.2
-
-## Changes by Kind
-
-### Bug or Regression
-
-- Fixed GitHub Actions workflow registry path issue for container image builds. Changed REGISTRY from `ghcr.io/syself/cluster-api-prod` to `ghcr.io/syself` to use the standard GHCR image naming format. This resolves the container push failures in the release workflow.