Gate customer-product releases with application acceptance and hosted reuse checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

.forgejo/workflows/application-tests.yaml

@@ -0,0 +1,27 @@
+name: Application acceptance
+
+on:
+  push:
+    branches: [main, 'factory/**']
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  application-tests:
+    runs-on: container-build
+    env:
+      DOCKER_HOST: tcp://127.0.0.1:2375
+    steps:
+      - name: Test the exact source and built assets
+        run: |
+          set -eu
+          REF="${GITHUB_SHA:?exact source revision required}"
+          mkdir -p buildctx /tmp/factory-docker-bin
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+          wget -qO- https://download.docker.com/linux/static/stable/x86_64/docker-27.3.1.tgz \
+            | tar xz --strip-components=1 -C /tmp/factory-docker-bin docker/docker
+          export PATH="/tmp/factory-docker-bin:${PATH}"
+          docker build --target application-tests buildctx

.forgejo/workflows/image.yaml

@@ -16,6 +16,7 @@ on:
       - "vergabe_teilnahme/**"
       - "static/**"
       - "templates/**"
+      - "conftest.py"
   workflow_dispatch:
 
 env:
@@ -42,6 +43,8 @@ jobs:
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           docker version
+          # Test the exact source before registry login or image publication.
+          docker build --target application-tests buildctx
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           SHORT="${REF:0:7}"
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
@@ -49,4 +52,4 @@ jobs:
           docker push "${IMAGE}:latest"
           docker push "${IMAGE}:${SHORT}"
           docker push "${IMAGE}:main-${SHORT}"
-          echo "pushed ${IMAGE}:latest ${IMAGE}:${SHORT}"
+          echo "pushed ${IMAGE}:latest ${IMAGE}:${SHORT}"