feat: build-push-sign-images composite action #2

Merged

robin.everaars merged 1 commit from feat/build-push-sign-images into main

2026-07-18 09:11:13 +00:00

robin.everaars commented

2026-07-18 08:54:55 +00:00

Owner

What

New composite action build-push-sign-images that centralises the toolbox
build-images build/push/cosign-sign orchestration: the runner-disk discipline
(upfront nix store gc, a gc-rooted signing toolchain, a per-image gc under a
threshold), the per-image continue-on-error and the fail-closed exit. This is
the last big piece of toolbox-local reusable CI logic in the centralisation
initiative (umbrella #134, this work #137).

Modes

Two modes cover the two flake-app shapes across the org:

copyto-sign (default, the toolbox shape): per image name, push
<flake>#<name>.copyTo then sign <flake>#<sign-app> -- <name>.
publish-app (the dp-engine / mkPublishImage shape, also website): per
target, run one self-contained build+push+sign app
<flake>#<app> -- <dest-ref>:<tag>.

The calling job keeps the container, the flake checkout and the registry/cosign
secrets. The action owns the loop and the disk discipline.

Verification

reuse lint: compliant.
shellcheck -s bash on the run body: clean.
Valid composite-action YAML (13 inputs).
README section added with an input table and both consumer examples.
Reviewed against every "must survive" invariant from the handover (disk
discipline, per-image continue-on-error + fail-closed, push-then-sign, the
caller-provided runner env). Two robustness caveats are documented: the
copyto-sign tag/registry coupling with the bundled sign-image signer
(which pins :latest, so the action warns on a mismatching tag), and the
publish-app shared-toolchain gc that dp-engine disables with
gc-threshold-gib: "0".

Follow-up

After merge, tag v0.4.0 on main. The ref form is
HOIST-IT-Actions/actions/[email protected], and the README already
documents that tag. The toolbox build-images.yaml migration (first consumer)
lands in a separate PR that references @v0.4.0; dp-engine (second consumer) is
coordinated with SwiftCove over agent-mail before its release.yml is touched.

## What New composite action `build-push-sign-images` that centralises the toolbox `build-images` build/push/cosign-sign orchestration: the runner-disk discipline (upfront `nix store gc`, a gc-rooted signing toolchain, a per-image gc under a threshold), the per-image continue-on-error and the fail-closed exit. This is the last big piece of toolbox-local reusable CI logic in the centralisation initiative (umbrella #134, this work #137). ## Modes Two modes cover the two flake-app shapes across the org: - `copyto-sign` (default, the toolbox shape): per image name, push `<flake>#<name>.copyTo` then sign `<flake>#<sign-app> -- <name>`. - `publish-app` (the dp-engine / mkPublishImage shape, also website): per target, run one self-contained build+push+sign app `<flake>#<app> -- <dest-ref>:<tag>`. The calling job keeps the container, the flake checkout and the registry/cosign secrets. The action owns the loop and the disk discipline. ## Verification - `reuse lint`: compliant. - `shellcheck -s bash` on the run body: clean. - Valid composite-action YAML (13 inputs). - README section added with an input table and both consumer examples. - Reviewed against every "must survive" invariant from the handover (disk discipline, per-image continue-on-error + fail-closed, push-then-sign, the caller-provided runner env). Two robustness caveats are documented: the copyto-sign `tag`/`registry` coupling with the bundled `sign-image` signer (which pins `:latest`, so the action warns on a mismatching tag), and the publish-app shared-toolchain gc that dp-engine disables with `gc-threshold-gib: "0"`. ## Follow-up After merge, tag `v0.4.0` on main. The ref form is `HOIST-IT-Actions/actions/[email protected]`, and the README already documents that tag. The toolbox `build-images.yaml` migration (first consumer) lands in a separate PR that references `@v0.4.0`; dp-engine (second consumer) is coordinated with SwiftCove over agent-mail before its `release.yml` is touched.

robin.everaars added 1 commit

2026-07-18 08:54:55 +00:00

feat: build-push-sign-images composite action 0df7827ac8

Extract the toolbox build-images build/push/cosign-sign orchestration into a
shared composite action so the runner-disk discipline and the fail-closed loop
live in one place for every image-building repo, instead of being re-pasted in
toolbox, dp-engine, website and sail.

Two modes cover the flake-app shapes in use. copyto-sign (default) reproduces
the toolbox shape: per image name, push `.#<name>.copyTo` then sign
`.#<sign-app> -- <name>`. publish-app fits the dp-engine / mkPublishImage shape:
per target, run one self-contained build+push+sign app `.#<app> -- <ref>:<tag>`.

The reusable core is the disk-GC discipline (upfront gc, a gc-rooted signing
toolchain, a per-image gc under a threshold), the per-image continue-on-error
and the fail-closed exit. The calling job keeps the container, the flake
checkout and the registry/cosign secrets.

Part of the CI centralisation initiative (umbrella #134, this work #137).

robin.everaars requested review from dajo.hofman

2026-07-18 08:54:55 +00:00

robin.everaars referenced this pull request

2026-07-18 09:06:35 +00:00

chore(license): relicense to Apache-2.0 #3

robin.everaars merged commit 923f72cd51 into main

2026-07-18 09:11:13 +00:00

robin.everaars deleted branch feat/build-push-sign-images

2026-07-18 09:11:13 +00:00

robin.everaars referenced this pull request from a commit

2026-07-18 09:11:14 +00:00

Merge pull request 'feat: build-push-sign-images composite action' (#2) from feat/build-push-sign-images into main