.github: group cleanup jobs by runner, notify after e2e

Author: charludo

.github/workflows/bm_build_image.yml

@@ -0,0 +1,57 @@
+name: build bare metal maintenance image
+
+on:
+  workflow_call:
+    secrets:
+      GITHUB_TOKEN_IN:
+        required: true
+      CACHIX_AUTH_TOKEN:
+        required: true
+    outputs:
+      image:
+        description: "Pushed cleanup-bare-metal image reference"
+        value: ${{ jobs.build-image.outputs.image }}
+
+env:
+  container_registry: ghcr.io/edgelesssys
+
+jobs:
+  build-image:
+    name: "Build cleanup-bare-metal image"
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      image: "${{ steps.build.outputs.image }}"
+    env:
+      SET: base
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup_nix
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN_IN || secrets.GITHUB_TOKEN }}
+          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1
+      - name: Log in to ghcr.io Container registry
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN_IN || secrets.GITHUB_TOKEN }}
+      - name: Create justfile.env
+        run: |
+          cat <<EOF > justfile.env
+          container_registry=${{ env.container_registry }}
+          set=${SET}
+          EOF
+      - name: Build and push cleanup-bare-metal image
+        id: build
+        env:
+          ghcr: ${{ env.container_registry }}
+        run: |
+          just push cleanup-bare-metal
+          image=$(sed -n "s#${{ env.container_registry }}/contrast/cleanup-bare-metal:latest=##p" ./workspace/just.containerlookup)
+          echo "image=${image}" >> "$GITHUB_OUTPUT"