trunk/3df983ce80ed6a6d81579f3964e5d53787483bed: Migrate docker-builds workflow to OSDC with remote BuildKit (#184664)

Two related changes to docker-builds.yml:

1. 
   

   Migrate the full .ci/docker/** image matrix to OSDC ARC runners.
   
   The orchestrator runs on a small mt-l-x86iavx512-2-4 runner inside
   
   ghcr.io/actions/actions-runner:latest; the actual build is
   
   offloaded to the cluster's remote BuildKit pools. BuildKit is a
   
   remote builder, so a single x86 orchestrator can drive both amd64
   
   and arm64 builds -- only the buildkit_addr differs per matrix row.

   
   

   Auth model:

   
   
   
   
   • ECR: reuses pytorch/pytorch/.github/actions/ecr-login@main,
     
     which falls through to OIDC on OSDC pods (no EC2 instance profile,
     
     no IRSA on the arc-runner ServiceAccount). We pass
     
     aws-role-to-assume: arn:aws:iam::308535385114:role/arc; a
     
     companion change in pytorch-gha-infra grants that role the ECR
     
     write actions on the pytorch/ci-image repository.
   
   
   • GHCR: unchanged (GHCR_PAT under the docker-build environment,
     
     gated on push events).
   
   
   
   

   Dropped:

   
   
   
   
   • pytorch/test-infra/.github/actions/calculate-docker-image and
     
     pull-docker-image: the tag is just git rev-parse HEAD:.ci/docker,
     
     computed inline.
   
   
   • chown-workspace, the legacy ecr-login composite step, and the
     
     nick-fields/retry wrapper for the GHCR push -- docker buildx imagetools create is a one-shot server-side cross-registry copy.
   
   
   
   

   .ci/docker/build.sh learns one knob, REMOTE_BUILDKIT. When set,
   
   it swaps --load -t <tmp> for --push (remote builders cannot load
   
   into a non-existent local daemon) and skips the post-build
   
   drun-based sanity checks. The EC2 / local-daemon path is unchanged.

   
   

   .github/actionlint.yaml learns the new mt-l-x86iavx512-2-4
   
   self-hosted runner label.

   
   


2. 
   

   Add a ciflow/docker tag trigger, mirroring how trunk.yml uses
   
   ciflow/trunk/*. Pushing a ciflow/docker/<sha> tag to any commit
   
   force-builds the matrix on that commit -- useful for testing
   
   Dockerfile edits without an open PR, or for re-running a build that
   
   failed transiently. The existing paths: filter on push: is
   
   removed because GitHub AND-combines tags with paths, which would
   
   silently block ciflow pushes on commits that didn't already touch
   
   .ci/docker. PR-side path filtering is preserved.

   
   

Authored by Claude.

Pull Request resolved: , https://github.com/malfet