Publish source-bound advisory-purpose overlay candidates through owner CI

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

.forgejo/workflows/purpose-overlay-image.yaml

@@ -0,0 +1,65 @@
+name: Publish exact advisory-purpose overlay candidate
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".forgejo/workflows/purpose-overlay-image.yaml"
+      - "deploy/purpose-overlay/**"
+      - "tools/purpose_overlay/**"
+      - "informed_decision/policy.py"
+  workflow_dispatch:
+concurrency:
+  group: informed-decision-purpose-overlay
+  cancel-in-progress: false
+permissions:
+  contents: read
+env:
+  REGISTRY: forgejo.coulomb.social
+  IMAGE_NAME: coulomb/informed-decision
+  DOCKER_HOST: tcp://127.0.0.1:2375
+jobs:
+  publish-candidate:
+    runs-on: container-build
+    steps:
+      - name: Verify and publish single-module overlay
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          umask 077
+          REF="${GITHUB_SHA:?exact source revision required}"
+          echo "${REF}" | grep -Eq '^[0-9a-f]{40}$'
+          test "${GITHUB_REPOSITORY}" = "coulomb/informed-decision"
+          if [ -z "${REGISTRY_USER:-}" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then
+            echo "Admitted repository registry publication capability is unavailable; no borrowed credential is permitted." >&2
+            exit 2
+          fi
+          BUILD_ROOT="$(mktemp -d)"
+          export DOCKER_CONFIG="${BUILD_ROOT}/docker-config"
+          cleanup() { rm -rf "${BUILD_ROOT}"; }
+          trap cleanup EXIT
+          mkdir -p "${BUILD_ROOT}/source" "${BUILD_ROOT}/overlay" "${DOCKER_CONFIG}" "${HOME}/bin"
+          wget -qO "${BUILD_ROOT}/source.tar.gz" "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf "${BUILD_ROOT}/source.tar.gz" -C "${BUILD_ROOT}/source" --strip-components=1
+          echo "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62  ${BUILD_ROOT}/source/informed_decision/policy.py" | sha256sum -c -
+          cp "${BUILD_ROOT}/source/informed_decision/policy.py" "${BUILD_ROOT}/overlay/policy.py"
+          cp "${BUILD_ROOT}/source/deploy/purpose-overlay/Containerfile" "${BUILD_ROOT}/overlay/Containerfile"
+          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
+          export PATH="${HOME}/bin:${PATH}"
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          BASE="${REGISTRY}/${IMAGE_NAME}@sha256:7f5c6cb29c9f70a026bfe30e72934274ddc69261676cf6d476f81dd32812d173"
+          docker pull "${BASE}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}:purpose-overlay-${REF}"
+          docker build --network none --pull=false --build-arg "SOURCE_REVISION=${REF}" --file "${BUILD_ROOT}/overlay/Containerfile" --tag "${IMAGE}" "${BUILD_ROOT}/overlay"
+          docker run --rm -i --network none --read-only --tmpfs /tmp:rw,noexec,nosuid,size=8m --entrypoint python "${IMAGE}" - < "${BUILD_ROOT}/source/tools/purpose_overlay/check_installed.py"
+          INSTALLED_POLICY_SHA="$(docker run --rm --network none --read-only --entrypoint sha256sum "${IMAGE}" /opt/venv/lib/python3.12/site-packages/informed_decision/policy.py | awk '{print $1}')"
+          test "${INSTALLED_POLICY_SHA}" = "9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
+          OUTPUT="$(docker push "${IMAGE}")"
+          printf '%s\n' "${OUTPUT}"
+          DIGEST="$(printf '%s\n' "${OUTPUT}" | tr '\r' '\n' | awk '{for(i=1;i<=NF;i++)if($i~/^sha256:[a-f0-9]{64}$/)print $i}' | tail -1)"
+          printf '%s' "${DIGEST}" | grep -Eq '^sha256:[a-f0-9]{64}$'
+          echo "published=${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
+          echo "source_revision=${REF}"
+          echo "policy_sha256=9d7c1be4cb6199d14ef0aaead5f85951f45b0ccbd7c800a7fde922a253566b62"
+          echo "candidate_only=true; native rollout, backup and restore require exact supervisor approval"