[docker] release tags always with the git sha

[rustielin]

Description

Always publish an additional tag that has the git hash suffix

We want image tags that look like this so it's easier to tell which commit they're from

aptos-node-v1.44.0-rc_performance_81916a3bb7b87cd7ab2a02ee4b3af87c76dc8176

Today we only tag them with

aptos-node-v1.44.0-rc_performance

How Has This Been Tested?

Dry run: https://github.com/aptos-labs/aptos-core/actions/runs/24473946144/job/71521169973

Includes this logline:

INFO: skipping copy of us-docker.pkg.dev/aptos-registry/docker/tools:performance_81916a3bb7b87cd7ab2a02ee4b3af87c76dc8176 to us-docker.pkg.dev/aptos-registry/docker/tools:aptos-node-v1.44.0-rc_performance and us-docker.pkg.dev/aptos-registry/docker/tools:aptos-node-v1.44.0-rc_performance_81916a3bb7b87cd7ab2a02ee4b3af87c76dc8176 due to dry run

Key Areas to Review

Type of Change

• New feature
• Bug fix
• Breaking change
• Performance improvement
• Refactoring
• Dependency update
• Documentation update
• Tests

Which Components or Systems Does This Change Impact?

• Validator Node
• Full Node (API, Indexer, etc.)
• Move/Aptos Virtual Machine
• Aptos Framework
• Aptos CLI/SDK
• Developer Infrastructure
• Move Compiler
• Other (specify)

Checklist

• I have read and followed the CONTRIBUTING doc
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I identified and added all stakeholders and component owners affected by this change as reviewers
• I tested both happy and unhappy path of the functionality
• I have made corresponding changes to the documentation

---

Note

Medium Risk
Changes the Docker image release/publish flow to push an additional tag per image, increasing registry writes and potentially affecting downstream consumers that rely on tag naming conventions.

Overview
Updates docker/release-images.mjs to always publish a second release tag that appends the current GIT_SHA (e.g. ..._performance_<sha>) alongside the existing non-SHA tag.

The script now computes imageTargetWithSha, logs both targets in dry-run and non-dry-run modes, and performs an extra crane copy to push the SHA-suffixed tag to each target registry.

^{Reviewed by Cursor Bugbot for commit 15f184c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

✅ Forge suite compat success on ca049383dd80675149ef2d0042668964f9f9107a ==> 15f184c579cd80fe42d858bf2d90ce59ad7bbb75

Compatibility test results for ca049383dd80675149ef2d0042668964f9f9107a ==> 15f184c579cd80fe42d858bf2d90ce59ad7bbb75 (PR)
1. Check liveness of validators at old version: ca049383dd80675149ef2d0042668964f9f9107a
compatibility::simple-validator-upgrade::liveness-check : committed: 14209.58 txn/s, latency: 2425.45 ms, (p50: 2400 ms, p70: 2700, p90: 3200 ms, p99: 3600 ms), latency samples: 467220
2. Upgrading first Validator to new version: 15f184c579cd80fe42d858bf2d90ce59ad7bbb75
compatibility::simple-validator-upgrade::single-validator-upgrade : committed: 6337.40 txn/s, latency: 5322.27 ms, (p50: 5900 ms, p70: 6000, p90: 6100 ms, p99: 6200 ms), latency samples: 219740
3. Upgrading rest of first batch to new version: 15f184c579cd80fe42d858bf2d90ce59ad7bbb75
compatibility::simple-validator-upgrade::half-validator-upgrade : committed: 6396.36 txn/s, latency: 5331.17 ms, (p50: 5800 ms, p70: 5900, p90: 6000 ms, p99: 6000 ms), latency samples: 221280
4. upgrading second batch to new version: 15f184c579cd80fe42d858bf2d90ce59ad7bbb75
compatibility::simple-validator-upgrade::rest-validator-upgrade : committed: 10948.73 txn/s, latency: 2990.37 ms, (p50: 3100 ms, p70: 3300, p90: 3500 ms, p99: 3900 ms), latency samples: 360940
5. check swarm health
Compatibility test for ca049383dd80675149ef2d0042668964f9f9107a ==> 15f184c579cd80fe42d858bf2d90ce59ad7bbb75 passed
Test Ok

• Grafana dashboard
• Humio Logs
• Axiom Logs
• Validator CPU Profile
• Fullnode CPU Profile
• Test runner output
• Test run is land-blocking

[github-actions]

✅ Forge suite realistic_env_max_load success on 15f184c579cd80fe42d858bf2d90ce59ad7bbb75

two traffics test: inner traffic : committed: 13929.80 txn/s, latency: 1295.49 ms, (p50: 1200 ms, p70: 1300, p90: 1500 ms, p99: 1900 ms), latency samples: 5202520
two traffics test : committed: 100.02 txn/s, latency: 692.16 ms, (p50: 600 ms, p70: 700, p90: 900 ms, p99: 1700 ms), latency samples: 1680
Latency breakdown for phase 0: ["MempoolToBlockCreation: max: 0.509, avg: 0.478", "ConsensusProposalToOrdered: max: 0.141, avg: 0.134", "ConsensusOrderedToCommit: max: 0.147, avg: 0.135", "ConsensusProposalToCommit: max: 0.284, avg: 0.269"]
Max non-epoch-change gap was: 1 rounds at version 74981 (avg 0.00) [limit 4], 1.11s no progress at version 74981 (avg 0.06s) [limit 15].
Max epoch-change gap was: 0 rounds at version 0 (avg 0.00) [limit 4], 0.40s no progress at version 2595089 (avg 0.40s) [limit 16].
Test Ok

• Grafana dashboard
• Humio Logs
• Axiom Logs
• Validator CPU Profile
• Fullnode CPU Profile
• Test runner output
• Test run is land-blocking