ci(giga-1): publish a mock_balances image alongside the vanilla one

[bdchatham]

Stacked on #4175. Base retargets to giga-1 automatically once that merges.

Why

giga1-ecr passes no build tags, so it publishes the vanilla binary. harbor's giga-testnet needs the mock_balances variant: that build credits every account, which is what lets a load generator skip a funding step for hundreds of thousands of accounts.

Without this, the only mock-balance tags available are mock-giga-1-<full sha> and the floating mock-giga-1, from the older giga-ecr workflow. Neither can be selected by a Flux numerical ImagePolicy — a 40-character hex digest carries no ordering, and a floating tag produces no new tag name for automation to notice. That is why the existing giga-testnet chain has sat paused naming an image nothing replaces.

What

One matrix variant, matching the shape giga-ecr.yml already uses:

variant	build tags	tag
vanilla	none	giga1-<ts>-<sha7>
mock_balances	mock_balances	mock-giga1-<ts>-<sha7>

The timestamp stays the committer date, as #4175 wrote it. Two builds that finish out of order still sort by commit, which is what a numerical policy needs.

The build cache is keyed per variant (build-cache:giga1-<variant>). The build tags change the compiled output, so one shared cache would miss on every run and evict the other variant.

Checks

• yaml.safe_load parses; the matrix resolves to ['vanilla', 'mock_balances']
• actionlint reports clean

Not in this PR

Once this lands, three container builds run on every push to giga-1: two from giga-ecr and two from giga1-ecr, of which two produce the same vanilla binary under different tags. Reconciling the two workflows is worth doing and belongs to whoever owns the publish path — I did not want to fold it into a change that is otherwise additive.

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
CI/publish workflow only; no application runtime or auth logic changes, only additive container tags and build args.

Overview
The giga1-ecr workflow now runs a two-variant matrix (vanilla and mock_balances) on each push to giga-1, matching the pattern already used in giga-ecr.yml.

Each variant gets its own ECR tag prefix (giga1-<ts>-<sha7> vs mock-giga1-<ts>-<sha7>), passes GO_BUILD_TAGS into the Docker build for the mock variant, and uses separate registry build caches (giga1-vanilla / giga1-mock_balances) so tagged builds do not invalidate each other. Job names and step summaries include the variant name for clarity.

^{Reviewed by Cursor Bugbot for commit ddc7360. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 16, 2026, 12:39 PM

[seidroid]

Clean, additive CI change: giga1-ecr becomes a two-variant matrix that publishes a mock_balances image alongside the vanilla one, with per-variant tag prefix and build cache. Verified the empty GO_BUILD_TAGS for the vanilla variant reproduces the pre-change build, the mock_balances tag is real and guarded in the Go tree, the interpolated shell value goes through an env: block, and the matrix shape matches the existing ecr.yml convention.

Findings: 0 blocking | 0 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• None at the file/PR level.