refactor image publishing

- run image build on push/pull
- publish dev tags
- separate pypi release from docker

.github/workflows/publish-image.yaml

@@ -4,6 +4,16 @@ on:
   release:
     types:
       - created
+  pull_request:
+    paths:
+      - kbatch-proxy/**
+      - .github/workflows/publish-image.yaml
+  push:
+    branches:
+      - main
+    paths:
+      - kbatch-proxy/**
+      - .github/workflows/publish-image.yaml
 
 env:
   REGISTRY: ghcr.io
@@ -16,63 +26,104 @@ jobs:
       contents: read
       packages: write
 
+    services:
+      # So that we can test this in PRs/branches
+      local-registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+
     steps:
+      - name: Should we push this image to a public registry?
+        if: github.event_name == 'pull_request'
+        run: |
+          echo "REGISTRY=localhost:5000" >> $GITHUB_ENV
+
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
-      - name: Get the version
-        id: get_version
-        run: |
-          echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
+      - name: Set up QEMU (for docker buildx)
+        uses: docker/setup-qemu-action@v3
 
-      - name: Log in to the Container registry
-        uses: docker/login-action@v2
+      - name: Set up Docker Buildx (for multi-arch builds)
+        uses: docker/setup-buildx-action@v3
+        with:
+          # Allows pushing to registry on localhost:5000
+          driver-opts: network=host
+
+      - name: Log in to the container registry
+        if: env.REGISTRY != 'localhost:5000'
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
-            ${{ env.VERSION }}
+            type=ref,event=tag
+            type=ref,event=branch
+            type=sha,prefix=dev-,event=branch
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v4
+        uses: docker/build-push-action@v5
         with:
           context: kbatch-proxy
+          platforms: linux/amd64,linux/arm64
           file: kbatch-proxy/docker/production/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+  build-pypi:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
-      - name: Set up Python 3.x
-        uses: actions/setup-python@v2
+      - name: Set up Python
+        uses: actions/setup-python@v5
         with:
           python-version: "3.x"
 
       - name: Install release dependencies
         run: |
           python -m pip install --upgrade build twine
+      
+      - name: Build releases
+        run: |
+          python3 -m build ./kbatch-proxy
+          python3 -m build ./kbatch
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kbatch-${{ github.sha }}
+          path: "kbatch/dist/*"
+          if-no-files-found: error
 
-      - name: Build and publish kbatch
+      - uses: actions/upload-artifact@v4
+        with:
+          name: kbatch-proxy-${{ github.sha }}
+          path: "kbatch-proxy/dist/*"
+          if-no-files-found: error
+
+      - name: Publish kbatch to PyPI
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           TWINE_USERNAME: "__token__"
           TWINE_PASSWORD: ${{ secrets.KBATCH_PYPI_PASSWORD }}
         run: |
-          cd kbatch
-          python -m build
-          twine upload dist/*
+          twine upload kbatch/dist/*
 
-      - name: Build and publish kbatch-proxy
+      - name: Publish kbatch-proxy to PyPI
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           TWINE_USERNAME: "__token__"
           TWINE_PASSWORD: ${{ secrets.KBATCH_PROXY_PYPI_PASSWORD }}
         run: |
-          cd kbatch-proxy
-          python -m build
-          twine upload dist/*
-          cd ..
+          twine upload kbatch-proxy/dist/*
+