Enable reusable Windows image publishing for CCCL

[jrhemstad]

Summary

• expose the existing Windows release workflow through workflow_call with a caller-provided image repository
• explicitly check out the devcontainers workflow source for cross-repository calls
• retain Docker Hub authentication for native releases and use the caller's GITHUB_TOKEN for ghcr.io/*
• ensure Docker is running on GitHub-hosted Windows runners, while leaving RAPIDS self-hosted runners unchanged
• preserve the existing Windows matrix, runner selection, build/test/push flow, concurrency, and tag generation

This is the prerequisite for a SHA-pinned workflow in NVIDIA/cccl to publish Windows images to ghcr.io/nvidia/cccl.

Validation

• repository pre-commit checks pass
• the native PR workflow's full Windows matrix passed (14/14 jobs): https://github.com/rapidsai/devcontainers/actions/runs/33585538257
• a cross-repository caller in NVIDIA/cccl invoked this exact commit and passed an internal-package preflight plus build, test, push, and logout in all 14 GitHub-hosted Windows jobs: https://github.com/NVIDIA/cccl/actions/runs/33660598173
• the internal smoke package was associated with NVIDIA/cccl and contained the expected 28 Windows tags (14 base plus 14 -windows2022 tags), one bootstrap tag, and no latest-* tags
• the disposable smoke package was deleted after validation

The failing Linux jobs in the PR run build current external RAPIDS sources and fail in cuDF on cuda::stream_ref::value(); they do not execute the changed Windows workflows. All Windows jobs and pre-commit checks passed.

Package visibility

Package visibility is caller-owned, not a registry-login concern. A new package created with the GITHUB_TOKEN inherits the caller repository's visibility, so a public NVIDIA/cccl caller would create a public package. The final package will therefore be bootstrapped once as internal before the first CCCL publish, then the linked CCCL repository's GITHUB_TOKEN will be used for normal publishing. The CCCL caller will fail closed unless the package already exists, is internal, and is associated with NVIDIA/cccl. No PAT, App token, or Docker Hub secret is passed to this reusable workflow.

GitHub documents these defaults under Publishing and installing a package with GitHub Actions.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[jrhemstad]

/ok to test a7a1c60

[jrhemstad]

/ok to test f0d3eeb

[jrhemstad]

Verified that this is working as intended.

A test branch workflow in nvidia/cccl was able to invoke this new workflow and successfully build internal packages

[jrhemstad]

Marking this back as draft. There's still some wonkiness with a manual step needed to be able to publish the images as internal.

[jrhemstad]

Sorted. TL;DR: If the first time a package is created is via a GitHub Actions workflow it will be a public package.

If you want to push to a private package from a GitHub Actions workflow, the package should be first manually created as internal.