Release workflow revision

2026-06-15 20:48:27 +02:00
parent f3211f0d45
commit 7b141f9760
3 changed files with 73 additions and 7 deletions
@@ -0,0 +1,49 @@
+# Manual compatibility publisher for the Crucible image.
+# Normal release publishing happens in build-image.yml on v* tags; this is the
+# break-glass / re-publish path, triggered by hand.
+#
+# Daemonless: built by Nix (`nix build .#image`) and pushed with skopeo from the
+# OCI tarball. No `docker build`/`docker login` involved.
+name: publish-image
+
+on:
+  workflow_dispatch:
+
+env:
+  REGISTRY: registry.westgate.pw
+  IMAGE: deployment/crucible
+
+jobs:
+  publish:
+    runs-on: nix-docker
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - name: Resolve tag
+        id: tag
+        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Build OCI image (daemonless)
+        run: nix build .#image
+
+      - name: Publish image
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          nix shell nixpkgs#skopeo -c skopeo copy \
+            --dest-creds "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
+            docker-archive:result \
+            "docker://${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}"
+
+      - name: Emit release fragment
+        run: |
+          FRAG_REPO=sow-tools \
+          FRAG_SHA=${{ steps.tag.outputs.sha }} \
+          FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
+          FRAG_URL="${REGISTRY}/${IMAGE}" \
+          FRAG_RUN_ID=${{ gitea.run_id }} \
+          bash scripts/emit-release-fragment.sh
+      - uses: actions/upload-artifact@v3
+        with: { name: release-fragment, path: release-fragment.json }