ci: Prepare Image Publishing for the Move to LibreChat-AI

[danny-avila]

Summary

This prepares the repository for its move to the LibreChat-AI organization: image publishing keeps working under the new owner, and the images deployments pull today keep being updated.

Both image workflows build tags from github.repository_owner. That value is the owner's name as written, and registries reject uppercase letters in a name: an owner like LibreChat-AI produces ghcr.io/LibreChat-AI/librechat-rag-api-dev, which is not a valid reference, and the push fails. The current owner is already lowercase, so this has never been exercised.

The tags now come from a lowercased owner. Under the current owner the published names are byte-for-byte what they are today, so this is a no-op until the owner changes.

How it works

GitHub's expression syntax has no lowercase function, so a shell step does it once per job and the tag list reads it back:

+        run: printf 'GHCR_IMAGE=ghcr.io/%s/%s\n' "${GITHUB_REPOSITORY_OWNER,,}" "$IMAGE_NAME" >> "$GITHUB_ENV"
           tags: |
-            ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}:${{ github.sha }}
+            ${{ env.GHCR_IMAGE }}:${{ github.sha }}

Applied in images.yaml (pushes :sha and :latest on main) and docker-build-workflow.yaml (the reusable workflow release.yaml calls on a tag).

Mirroring the old namespace

After the move, images publish to ghcr.io/librechat-ai/* while every deployment still pulls librechat-rag-api-dev* from the old namespace, directly or through registry.librechat.ai, which passes the path to ghcr.io unchanged. Both workflows now copy each published tag to a second, configurable namespace, so those deployments keep updating and the new namespace becomes canonical without a flag day. Copies are GHCR cross-repo blob mounts: no image data is rebuilt or re-uploaded.

release.yaml now passes secrets: inherit, because a called workflow receives no secrets otherwise.

It skips rather than fails when: LEGACY_GHCR_OWNER is unset (the step doesn't run), the legacy owner equals the publishing owner (the case today, so nothing mirrors onto itself), or the secret is missing (warns, exits 0). A failed copy is continue-on-error, so a registry hiccup can't fail a publish.

To turn it on after the move: add a token with write:packages for danny-avila as LEGACY_GHCR_TOKEN, and set the LEGACY_GHCR_OWNER variable to danny-avila. Remove both when the deprecation window closes.

This mirrors what LibreChat#16214 does for the main images.

Testing

• actionlint 1.7.7 reports no problem with the changed lines. It does flag three pre-existing ones, unchanged by this PR: docker/login-action@v2 in both image workflows and actions/setup-python@v4 in ci.yml are too old for current runners. Worth a separate bump.
• I ran the mirror step's shell body with post-move values (GITHUB_REPOSITORY_OWNER=LibreChat-AI, legacy owner danny-avila): it resolves ghcr.io/librechat-ai/librechat-rag-api-dev:{abc1234,latest} → ghcr.io/danny-avila/…, and with today's owner on both sides it exits early.
• The expansion with an uppercase owner gives ghcr.io/librechat-ai/librechat-rag-api-dev; with the current owner it gives today's name unchanged.
• These workflows only run on pushes to main, tags and dispatch, so the next image build after merge is the first real exercise.