feat(orchestrator,core): carry verify into the audit export (#15) (#144) #93
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: pangolin-worker-image | |
| # Build + push the stock pangolin-worker OCI image to GHCR. | |
| # | |
| # Triggers (per spec §9 acceptance + §7.4 image-pinning posture): | |
| # - push to main → publishes `:main` plus the immutable digest | |
| # - tag push matching v* → publishes `:latest` + `:<version>` + the digest | |
| # - manual workflow_dispatch | |
| # | |
| # The digest emitted by docker/build-push-action@v5 is surfaced as a job | |
| # output so downstream automation (or a follow-up commit) can pin the | |
| # hello-world example to the published `name@sha256:<digest>` reference. | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| workflow_dispatch: | |
| concurrency: | |
| group: pangolin-worker-image-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| REGISTRY: ghcr.io | |
| # GHCR namespace must match the lowercase GitHub org slug (`quarrysystems`, | |
| # no hyphen). The npm scope `@quarry-systems/*` keeps the hyphenated form — | |
| # see /memory/pangolin-identity-split.md for the why. | |
| IMAGE_NAME: quarrysystems/pangolin-worker | |
| jobs: | |
| build-and-push: | |
| name: build + push | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| outputs: | |
| digest: ${{ steps.build.outputs.digest }} | |
| image_ref: ${{ steps.refs.outputs.image_ref }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Compute image tags | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }} | |
| type=sha,prefix=sha- | |
| - name: Build + push | |
| id: build | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: docker/pangolin-worker/Dockerfile | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| provenance: true | |
| sbom: true | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Compose digest-pinned ref | |
| id: refs | |
| run: | | |
| echo "image_ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT" | |
| - name: Summary | |
| run: | | |
| { | |
| echo "### pangolin-worker image published" | |
| echo "" | |
| echo "**Digest-pinned ref (use this in production dispatches per §7.4):**" | |
| echo "" | |
| echo '```' | |
| echo "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}" | |
| echo '```' | |
| echo "" | |
| echo "**Mutable tags:**" | |
| echo "" | |
| echo '```' | |
| echo "${{ steps.meta.outputs.tags }}" | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" |