ci: split Docker Hub and GHCR manifest jobs to prevent rate limit failures

.github/workflows/build-and-publish.yml

@@ -206,12 +206,11 @@ jobs:
           cache-from: type=gha,scope=arm64-${{ matrix.mode.name }}
           cache-to: type=gha,mode=max,scope=arm64-${{ matrix.mode.name }}
 
-  # Merge manifests after both platforms are built
+  # Merge GHCR manifests after both platforms are built
-  merge-manifests:
+  merge-manifests-ghcr:
     runs-on: ubuntu-latest
     needs: [build-amd64, build-arm64]
     permissions:
-      contents: write
       packages: write
     strategy:
       matrix:
@@ -221,12 +220,6 @@ jobs:
           - name: simple
             suffix: "-simple"
     steps:
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
@@ -249,23 +242,9 @@ jobs:
             echo "is_release=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Create and push manifest (release)
+      - name: Create and push GHCR manifest (release)
         if: steps.version.outputs.is_release == 'true'
         run: |
-          # DockerHub manifests
-          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:latest \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
-          
-          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }} \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
-          
-          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version_without_v }} \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
-          
-          # GHCR manifests
           docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:latest \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
@@ -278,19 +257,9 @@ jobs:
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
 
-      - name: Create and push manifest (edge)
+      - name: Create and push GHCR manifest (edge)
         if: steps.version.outputs.is_release == 'false'
         run: |
-          # DockerHub manifests
-          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-amd64 \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-arm64
-          
-          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:sha-${{ steps.version.outputs.short_sha }} \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-amd64 \
-            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-arm64
-          
-          # GHCR manifests
           docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:edge \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:edge-amd64 \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:edge-arm64
@@ -298,3 +267,64 @@ jobs:
           docker buildx imagetools create -t ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:sha-${{ steps.version.outputs.short_sha }} \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:edge-amd64 \
             ghcr.io/${{ github.repository_owner }}/bentopdf${{ matrix.mode.suffix }}:edge-arm64
+
+  # Merge DockerHub manifests (separate job, can fail independently)
+  merge-manifests-dockerhub:
+    runs-on: ubuntu-latest
+    needs: [build-amd64, build-arm64]
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        mode:
+          - name: default
+            suffix: ""
+          - name: simple
+            suffix: "-simple"
+    steps:
+      - name: Login to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Extract version
+        id: version
+        run: |
+          if [[ $GITHUB_REF == refs/tags/v* ]]; then
+            VERSION=${GITHUB_REF#refs/tags/}
+            echo "version=${VERSION}" >> $GITHUB_OUTPUT
+            echo "version_without_v=${VERSION#v}" >> $GITHUB_OUTPUT
+            echo "is_release=true" >> $GITHUB_OUTPUT
+          else
+            SHORT_SHA=${GITHUB_SHA::7}
+            echo "version=edge" >> $GITHUB_OUTPUT
+            echo "short_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
+            echo "is_release=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create and push DockerHub manifest (release)
+        if: steps.version.outputs.is_release == 'true'
+        run: |
+          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:latest \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
+
+          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }} \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
+
+          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version_without_v }} \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-amd64 \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:${{ steps.version.outputs.version }}-arm64
+
+      - name: Create and push DockerHub manifest (edge)
+        if: steps.version.outputs.is_release == 'false'
+        run: |
+          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-amd64 \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-arm64
+
+          docker buildx imagetools create -t bentopdfteam/bentopdf${{ matrix.mode.suffix }}:sha-${{ steps.version.outputs.short_sha }} \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-amd64 \
+            bentopdfteam/bentopdf${{ matrix.mode.suffix }}:edge-arm64