Build C extraction docker image on CI

[jschneider-bensch]

          Can you file an issue to have the CI build the docker image at some point? Then we don't need to do that manually every time we update something here.

Originally posted by @franziskuskiefer in #416 (comment)

• publish docker image to GitHub packages
• rebuild image when a file in the directory changes
• don't run c.yml when something in docker/c changes
• use GH hosted image in all workflows
• publish new image when PR that updates it gets merged
• update C extraction bash scripts to write revisions when extracting in the docker image
• clean docker image to reduce size, e.g. clean Rust builds (install and clean), drop unused Rust toolchains, etc. Clean up libcrux-c docker image #818
• add status job to docker build job, like in c.yml Add status job to docker build job #819

---

• Workflow that
  • builds the docker image
  • publishes the docker image to ghcr.io with an unstable tag (maybe with the revision as tag?)
  • uses the new docker image to extract C code (from c.yml)
  • run tests on the newly extracted C code (from c.yml)
  • fail if any of these step fails
• Second workflow to tag an existing docker image on ghrc.io as latest

Steps from c.yml

There are more places where things are extracted and tested. But here are two parts for ml-kem as example.

libcrux/.github/workflows/c.yml

Line 16 in 20dc15a

extract:

libcrux/.github/workflows/c.yml

Line 144 in 20dc15a

build:

[franziskuskiefer]

We finally got a new F* release and should update to use new versions of everything. As part of that we should also fix this issue.
I started an action that could be a starting point, but it fails with permission issues (ERROR: unauthorized: access token has insufficient scopes) for now.

[github-actions]

This issue has been marked as stale due to a lack of activity for 60 days. If you believe this issue is still relevant, please provide an update or comment to keep it open. Otherwise, it will be closed in 7 days.

[franziskuskiefer]

we may want to allow using other tags for testing other revisions.

posted by @franziskuskiefer in #791 (comment)

[franziskuskiefer]

The main parts are done here. Closing this. The two open items will be done in the corresponding follow up issues.