Build immutable policy publication artifact

.forgejo/workflows/publish-image.yaml

@@ -0,0 +1,73 @@
+# Uses the estate's tier-2 container-build runner and organization-scoped
+# REGISTRY_USER / REGISTRY_TOKEN secrets.
+name: Build and publish policy-nexus image
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".forgejo/workflows/publish-image.yaml"
+      - "Containerfile"
+      - "deploy/**"
+      - "publication.json"
+      - "tests/**"
+      - "tools/**"
+  workflow_dispatch:
+
+env:
+  REGISTRY: forgejo.coulomb.social
+  IMAGE_NAME: coulomb/policy-nexus
+  DOCKER_HOST: tcp://127.0.0.1:2375
+
+jobs:
+  build-and-push:
+    runs-on: container-build
+    steps:
+      - name: Build, verify, and publish immutable policy artifact
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          REF="${GITHUB_SHA:-main}"
+          SHORT="${REF:0:7}"
+          mkdir -p buildctx/_sources/net-kingdom "${HOME}/bin"
+
+          wget -qO /tmp/policy-nexus.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${SHORT}.tar.gz"
+          tar xzf /tmp/policy-nexus.tar.gz -C buildctx --strip-components=1
+
+          NETKINGDOM_REVISION=$(git ls-remote \
+            https://forgejo.coulomb.social/coulomb/net-kingdom.git \
+            refs/heads/main | awk '{print $1}')
+          test -n "$NETKINGDOM_REVISION"
+          NETKINGDOM_SHORT="$(printf '%s' "$NETKINGDOM_REVISION" | cut -c1-7)"
+          wget -qO /tmp/net-kingdom.tar.gz \
+            "https://forgejo.coulomb.social/coulomb/net-kingdom/archive/${NETKINGDOM_SHORT}.tar.gz"
+          tar xzf /tmp/net-kingdom.tar.gz \
+            -C buildctx/_sources/net-kingdom --strip-components=1
+
+          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
+            | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
+          export PATH="${HOME}/bin:${PATH}"
+          docker version
+          echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" \
+            -u "${REGISTRY_USER}" --password-stdin
+
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          docker build \
+            --file buildctx/Containerfile \
+            --build-arg "VCS_REVISION=${REF}" \
+            --build-arg "NETKINGDOM_REVISION=${NETKINGDOM_REVISION}" \
+            --tag "${IMAGE}:git-${REF}" \
+            --tag "${IMAGE}:main" \
+            buildctx
+          docker push "${IMAGE}:git-${REF}"
+          docker push "${IMAGE}:main"
+
+          PUBLICATION_DIGEST=$(docker run --rm --entrypoint sha256sum \
+            "${IMAGE}:git-${REF}" /usr/share/nginx/html/publication-manifest.json \
+            | awk '{print $1}')
+          echo "published=${IMAGE}:git-${REF}"
+          echo "publication_manifest_digest=${PUBLICATION_DIGEST}"