[AMD] mirror nightly images to local registry and prefer LAN pulls (#23073)

Co-authored-by: bingxche <bingxche@amd.com>

.github/workflows/release-docker-amd-rocm720-nightly.yml

@@ -82,6 +82,22 @@ jobs:
           docker build . -f docker/rocm.Dockerfile --build-arg SGL_BRANCH=${{ github.ref_name }} --build-arg BUILD_TYPE=${{ matrix.build_type }} --build-arg GPU_ARCH=${{ matrix.gpu_arch }} --build-arg ENABLE_MORI=1 --build-arg NIC_BACKEND=ainic --build-arg SETUPTOOLS_SCM_PRETEND_VERSION=${pretend_version} -t rocm/sgl-dev:${tag}-${{ env.DATE }} --no-cache
           docker push rocm/sgl-dev:${tag}-${{ env.DATE }}
 
+      # Persist the tag right after rocm/sgl-dev push succeeds so the local
+      # registry mirror can run even if a later step in this job (lmsys push)
+      # fails. By default this step only runs when the previous step succeeded,
+      # so the artifact only exists when an image actually landed on Docker Hub.
+      - name: Save published image tag
+        run: |
+          mkdir -p image-tag
+          echo "${{ env.IMAGE_TAG }}" > "image-tag/${{ matrix.gpu_arch }}.txt"
+
+      - name: Upload image tag artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-tag-${{ matrix.gpu_arch }}
+          path: image-tag/${{ matrix.gpu_arch }}.txt
+          retention-days: 1
+
       - name: Login to Docker Hub (lmsys)
         uses: docker/login-action@v2
         with:
@@ -92,3 +108,49 @@ jobs:
         run: |
           docker tag rocm/sgl-dev:${{ env.IMAGE_TAG }} lmsysorg/sglang-rocm:${{ env.IMAGE_TAG }}
           docker push lmsysorg/sglang-rocm:${{ env.IMAGE_TAG }}
+
+  # Mirror the freshly published rocm/sgl-dev image to the in-network Docker
+  # registry so AMD CI runners can pull without hitting Docker Hub rate limits.
+  # The tag is read verbatim from the publish job's artifact so this job uses
+  # exactly the same tag that publish pushed (only the registry prefix differs).
+  # `!cancelled()` lets us still mirror successful matrix legs when other legs
+  # of publish failed; legs without an artifact will fail at download and be
+  # the only ones marked red.
+  push_local_registry:
+    if: ${{ !cancelled() && github.repository == 'sgl-project/sglang' }}
+    runs-on: linux-mi300-1gpu-sglang
+    environment: 'prod'
+    needs: publish
+    strategy:
+      fail-fast: false
+      matrix:
+        gpu_arch: ['gfx942-rocm720', 'gfx950-rocm720']
+    steps:
+      - name: Download image tag artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: image-tag-${{ matrix.gpu_arch }}
+
+      - name: Read image tag
+        run: |
+          image_tag=$(tr -d '[:space:]' < "${{ matrix.gpu_arch }}.txt")
+          if [ -z "${image_tag}" ]; then
+            echo "::error::Image tag artifact is empty"
+            exit 1
+          fi
+          echo "IMAGE_TAG=${image_tag}" >> $GITHUB_ENV
+          echo "Resolved IMAGE_TAG=${image_tag}"
+
+      - name: Login to Docker Hub (AMD)
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_AMD_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_AMD_TOKEN }}
+
+      - name: Mirror rocm/sgl-dev to local registry
+        run: |
+          src="rocm/sgl-dev:${{ env.IMAGE_TAG }}"
+          dst="172.29.8.23:5000/rocm/sgl-dev:${{ env.IMAGE_TAG }}"
+          docker pull "${src}"
+          docker tag "${src}" "${dst}"
+          docker push "${dst}"