feat(ci): don't push to dockerhub outside of release builds

dev/ci/internal/ci/images_operations.go

@@ -95,12 +95,14 @@ func bazelPushImagesCmd(c Config, isCandidate bool, opts ...bk.StepOpt) func(*bk
 	}
 	// Default registries.
 	devRegistry := images.SourcegraphDockerDevRegistry
-	prodRegistry := images.SourcegraphDockerPublishRegistry
-	additionalProdRegistry := images.SourcegraphArtifactRegistryPublicRegistry
+	prodRegistry := images.SourcegraphArtifactRegistryPublicRegistry
+	var additionalProdRegistry string
 
 	// If we're building an internal release, we push the final images to that specific registry instead.
 	// See also: release_operations.go
 	switch c.RunType {
+	case runtype.PromoteRelease:
+		additionalProdRegistry = images.SourcegraphDockerPublishRegistry
 	case runtype.InternalRelease:
 		prodRegistry = images.SourcegraphInternalReleaseRegistry
 		// we don't want to push to the public registry on internal releases, but we do want to publish the release to the cloud ephemeral registry

dev/ci/internal/ci/release_operations.go

@@ -58,7 +58,7 @@ func releasePromoteImages(c Config) operations.Operation {
 // releaseTestOperations runs the script defined in release.yaml that tests the release.
 func releaseTestOperation(c Config) operations.Operation {
 	devRegistry := images.SourcegraphDockerDevRegistry
-	prodRegistry := images.SourcegraphDockerPublishRegistry
+	prodRegistry := images.SourcegraphArtifactRegistryPublicRegistry
 
 	if c.RunType.Is(runtype.InternalRelease) {
 		prodRegistry = images.SourcegraphInternalReleaseRegistry

doc/dev/background-information/sg/index.md

@@ -245,7 +245,7 @@ OFFLINE=true sg start
 Ensure that the `sourcegraph/syntax-highlighter:insiders` image is already available locally. If not, pull it with the following command before going offline to ensure that offline mode works seamlessly:
 
 ```bash
-docker pull -q sourcegraph/syntax-highlighter:insiders
+docker pull -q us-docker.pkg.dev/sourcegraph-public-images/sourcegraph-public-images/syntax-highlighter:insiders
 ```
 
 ## `sg` and pre-commit hooks

sg.config.yaml

@@ -590,15 +590,15 @@ commands:
     cmd: |
       docker run --name=syntax-highlighter --rm -p9238:9238 \
       -e WORKERS=1 -e ROCKET_ADDRESS=0.0.0.0 \
-      sourcegraph/syntax-highlighter:insiders
+      us-docker.pkg.dev/sourcegraph-public-images/sourcegraph-public-images/syntax-highlighter:insiders
     install: |
       # Remove containers by the old name, too.
       docker inspect syntect_server >/dev/null 2>&1 && docker rm -f syntect_server || true
       docker inspect syntax-highlighter >/dev/null 2>&1 && docker rm -f syntax-highlighter || true
       # Pull syntax-highlighter latest insider image, only during install, but
       # skip if OFFLINE=true is set.
       if [[ "$OFFLINE" != "true" ]]; then
-          docker pull -q sourcegraph/syntax-highlighter:insiders
+          docker pull -q us-docker.pkg.dev/sourcegraph-public-images/sourcegraph-public-images/syntax-highlighter:insiders
       fi
 
   zoekt-indexserver-template: &zoekt_indexserver_template