Org is 'limited' so buildx 401s pulling a private FROM base. Add an optional ci-bot token input; when set, docker/login-action authenticates before build (mirrors image-push). Public-base builds (base = FROM debian) omit it. Removes the need for a separate per-workflow login step.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Lets a caller point at a non-default Dockerfile while keeping the
build context broader. Needed for repos with multiple binaries sharing
internal packages (api/Dockerfile + worker/Dockerfile, build context
at repo root). Empty default preserves prior behavior.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>