chore: remove Docker image build and publishing [PYSDK-156]

.copier-answers.yml

@@ -5,7 +5,7 @@ author_email: helmut@aignostics.com
 author_github_username: helmut-hoffer-von-ankershoffen
 author_name: Helmut Hoffer von Ankershoffen
 codeql_enabled: true
-docker_io_enabled: true
+docker_io_enabled: false
 docker_io_image_name: aignostics-python-sdk
 docker_io_owner: helmuthva
 github_repository_name: python-sdk

.github/CLAUDE.md

@@ -13,7 +13,7 @@ workflows (`> …`, prefixed `_`) are called via `uses:`.
 
 | Entry point | Trigger | Calls |
 |-------------|---------|-------|
-| `ci-cd.yml` | push (main, release/v*, tag v*.*.*), PR (main, release/v*), release created, workflow_dispatch | `_lint`, `_docs`, `_audit`, `_test`, `_codeql`, `_ketryx_report_and_check`, `_package-publish`, `_docker-publish` |
+| `ci-cd.yml` | push (main, release/v*, tag v*.*.*), PR (main, release/v*), release created, workflow_dispatch | `_lint`, `_docs`, `_audit`, `_test`, `_codeql`, `_ketryx_report_and_check`, `_package-publish` |
 | `prepare-release.yml` | workflow_dispatch | — |
 | `publish-release.yml` | workflow_dispatch | — |
 | `merge-release.yml` | workflow_dispatch | — |
@@ -30,9 +30,9 @@ workflows (`> …`, prefixed `_`) are called via `uses:`.
 | `labels-sync.yml` | push to label config | — |
 
 Reusable: `_lint`, `_docs`, `_audit`, `_test`, `_codeql`,
-`_ketryx_report_and_check`, `_package-publish`, `_docker-publish`,
-`_build-native-only`, `_claude-code`, `_scheduled-audit`,
-`_scheduled-test-hourly`, `_scheduled-test-daily`, `_scheduled-test-stress`.
+`_ketryx_report_and_check`, `_package-publish`, `_build-native-only`,
+`_claude-code`, `_scheduled-audit`, `_scheduled-test-hourly`,
+`_scheduled-test-daily`, `_scheduled-test-stress`.
 (`stress-testing-staging.yml.paused` is currently disabled.)
 
 ## Main pipeline (`ci-cd.yml`)
@@ -46,19 +46,18 @@ Reusable: `_lint`, `_docs`, `_audit`, `_test`, `_codeql`,
 
 **Jobs**: `get-commit-message` (extracts commit message + release version from
 branch), `lint`, `docs`, `audit`, `test`, `codeql`, `sonarcloud`,
-`ketryx_report_and_check`, `package_publish`, `docker_publish`.
+`ketryx_report_and_check`, `package_publish`.
 
 **Dependency graph**:
 
 ```text
 get-commit-message ──> lint, docs, audit, test, codeql
                        test ──> sonarcloud
 lint, audit, test, codeql, sonarcloud, docs ──> ketryx_report_and_check
-                                                 ├──> package_publish (tags only)
-                                                 └──> docker_publish  (tags only)
+                                                 └──> package_publish (tags only)
 ```
 
-`package_publish`/`docker_publish` run only on `refs/tags/v*`.
+`package_publish` runs only on `refs/tags/v*`.
 `ketryx_report_and_check` is skipped for `dependabot[bot]`.
 
 ## Test execution (`_test.yml`)
@@ -177,8 +176,7 @@ GitHub secrets: `ANTHROPIC_API_KEY`,
 `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`,
 `GCP_CREDENTIALS_{STAGING,PRODUCTION}` (base64 JSON), the BetterStack URLs above,
 `CODECOV_TOKEN`, `SONAR_TOKEN`, `SENTRY_DSN`/`SENTRY_AUTH_TOKEN`,
-`UV_PUBLISH_TOKEN`, `DOCKER_USERNAME`/`DOCKER_PASSWORD`,
-`KETRYX_PROJECT`/`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`.
+`UV_PUBLISH_TOKEN`, `KETRYX_PROJECT`/`KETRYX_API_KEY`, `SLACK_*_RELEASE_ANNOUNCEMENT`.
 
 Local `.env` for E2E:
 

.github/copilot-instructions.md

@@ -86,9 +86,8 @@ make lint            # Ruff formatting + MyPy type checking
 - Add dependencies: `uv add <package>`
 
 **Testing:**
-- Pytest with markers: `sequential`, `long_running`, `scheduled`, `docker`, `skip_with_act`
+- Pytest with markers: `sequential`, `long_running`, `scheduled`, `skip_with_act`
 - Run specific tests: `uv run pytest tests/path/test.py::test_function`
-- Docker integration: `make test-docker`
 
 ## Code Patterns & Standards
 

.github/workflows/_build-native-only.yml

@@ -35,7 +35,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
 
     steps:
       - name: Checkout

.github/workflows/_package-publish.yml

@@ -44,7 +44,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
 
     steps:
       - name: Checkout

.github/workflows/_scheduled-test-daily.yml

@@ -45,7 +45,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
     steps:
 
       - name: Checkout

.github/workflows/_test.yml

@@ -69,7 +69,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
     steps:
 
       - name: Checkout

.github/workflows/build-native-only.yml

@@ -81,4 +81,4 @@ jobs:
       attestations: write
       contents: write
       id-token: write
-      packages: write
+      packages: read

.github/workflows/ci-cd.yml

@@ -134,7 +134,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
     secrets:
       AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }}
       AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }}
@@ -195,7 +195,7 @@ jobs:
       attestations: write
       contents: write
       id-token: write
-      packages: write
+      packages: read
     secrets:
       KETRYX_PROJECT: ${{ secrets.KETRYX_PROJECT }}
       KETRYX_API_KEY: ${{ secrets.KETRYX_API_KEY }}
@@ -214,26 +214,9 @@ jobs:
       attestations: write
       contents: write
       id-token: write
-      packages: write
+      packages: read
     secrets:
       UV_PUBLISH_TOKEN: ${{ secrets.UV_PUBLISH_TOKEN }}
       SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT: ${{ secrets.SLACK_WEBHOOK_URL_RELEASE_ANNOUNCEMENT }}
       SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT: ${{ secrets.SLACK_CHANNEL_ID_RELEASE_ANNOUNCEMENT }}
       SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-
-  docker_publish:
-    needs: [get-commit-message, ketryx_report_and_check]
-    if: |
-      (startsWith(github.ref, 'refs/tags/v') && (!contains(needs.get-commit-message.outputs.commit_message, 'skip:ci'))) &&
-      (!contains(needs.get-commit-message.outputs.commit_message, 'build:native:only')) &&
-      (!contains(github.event.pull_request.labels.*.name, 'skip:ci')) &&
-      (!contains(github.event.pull_request.labels.*.name, 'build:native:only'))
-    uses: ./.github/workflows/_docker-publish.yml
-    permissions:
-      attestations: write
-      contents: read
-      id-token: write
-      packages: write
-    secrets:
-      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/scheduled-testing-production-daily.yml

@@ -21,7 +21,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
     secrets:
       AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }}
       AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }}

.github/workflows/scheduled-testing-staging-daily.yml

@@ -21,7 +21,7 @@ jobs:
       attestations: write
       contents: read
       id-token: write
-      packages: write
+      packages: read
     secrets:
       AIGNOSTICS_CLIENT_ID_DEVICE_STAGING: ${{ secrets.AIGNOSTICS_CLIENT_ID_DEVICE_STAGING }}
       AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }}