draft: add image build, push, and promotion workflows

.github/workflows/image-push.yml

@@ -0,0 +1,44 @@
+name: Image Build and Push
+
+on:
+  workflow_dispatch:
+    inputs:
+      run_ci_build_push:
+        description: 'Check to enable mutating registry push'
+        required: true
+        type: boolean
+
+jobs:
+  build_and_push:
+    if: ${{ github.event.inputs.run_ci_build_push == 'true' }}
+    name: Build and Push Images
+    runs-on: ubuntu-latest
+    environment: image-push
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build Sailr
+        run: cargo build --release
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run CI Build and Push Workflow
+        run: target/release/sailr workflow run ci-build-push --non-interactive --apply
+
+      - name: Upload Image Report
+        uses: actions/upload-artifact@v4
+        with:
+          name: image-report
+          path: .sailr/reports/ci-build-push/latest.json

.github/workflows/rust.yml

@@ -10,18 +10,30 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  build:
+  format:
+    name: Format
     runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
 
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - run: cargo clippy --all-targets -- -D warnings
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - name: Set up Rust
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        components: rustfmt, clippy
-    - name: Run Check Formatting
-      run: cargo fmt --all -- --check
-    - name: Run Clippy
-      run: cargo clippy -- -D warnings
-    - name: Run Tests
-      run: cargo test --verbose
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test

.github/workflows/sailr-ci.yml

@@ -24,6 +24,7 @@ jobs:
         profile:
           - ci
           - ci-build-plan
+          - ci-build-push-plan
           - ci-generate
           - ci-deploy-plan
 

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sailr Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

docs/PR-17.md

@@ -0,0 +1,14 @@
+### Stage 3: `ci-build-push`
+Status: complete
+
+Includes:
+- `ci-build-push` profile.
+- Manual protected image push workflow.
+- GHCR login.
+- Runtime image report accumulator.
+- Mandatory digest capture.
+- Digest-bearing `ImageArtifact` reports.
+- `push=run` plan/graph/explain support.
+
+### Stage 4: promotion plan
+Status: next

docs/pilots/circleci-external-repo.md

@@ -0,0 +1,36 @@
+# CircleCI External Repo Pilot
+
+## External repo
+https://github.com/josh-tracey/sailr-travis-pilot
+
+## Sailr revision
+`experiment/runkernel`
+
+## CI provider
+CircleCI
+
+## Registry
+`europe-west2-docker.pkg.dev` (GCP Artifact Registry)
+
+## Service
+`skyfleet`
+
+## Profiles tested
+- `ci-build-push-plan`
+- `ci-build-push`
+
+## What passed
+- Sailr installed from Git revision.
+- Push plan ran in CircleCI.
+- CircleCI approval gate configured and worked.
+- Sailr accepted `approval = external`.
+- Image pushed to registry (GCP).
+- Digest captured.
+- Report validated with jq.
+
+## Issues found
+- Initial failure: `CI push requires approval=external`.
+- Resolution: Kept `approval = external` in `sailr.workflow.toml` and added `approve_image_push` job of `type: approval` to CircleCI configuration to align manual approval gates with Sailr's CI safety constraints.
+
+## Follow-up work
+- Provider-specific error messages implemented in Sailr (`src/workflow/runner.rs`) to guide developers towards correct CI setups for CircleCI, GitHub Actions, and Travis.

k8s/environments/staging/config.toml

@@ -3,7 +3,7 @@ name = "staging"
 log_level = "INFO"
 domain = "staging.example.local"
 default_replicas = 1
-registry = "docker.io"
+registry = "ttl.sh"
 
 [[service]]
 name = "hello-sailr"
@@ -14,3 +14,7 @@ path = "hello-sailr"
 name = "ci-build-hello"
 version = "ci"
 path = "examples/ci-build/hello"
+
+[service.build]
+path = "examples/ci-build/hello"
+include = ["Dockerfile", "index.html"]

sailr.workflow.toml

@@ -72,3 +72,27 @@ namespace = "default"
 approval = "external"
 apply = true
 report = "both"
+
+[workflow.ci-build-push-plan]
+environment = "staging"
+mode = "build"
+interactive = false
+build = "plan"
+push = "plan"
+generate = "disabled"
+deploy = "disabled"
+approval = "none"
+apply = false
+report = "both"
+
+[workflow.ci-build-push]
+environment = "staging"
+mode = "build"
+interactive = false
+build = "run"
+push = "run"
+generate = "disabled"
+deploy = "disabled"
+approval = "external"
+apply = true
+report = "both"