Mirror public images to internal registry

.gitattributes

@@ -0,0 +1 @@
+mirror_images.lock.yaml linguist-generated=true

.gitlab-ci.yml

@@ -7,6 +7,7 @@ stages:
   - build-and-test-fast
   - build-all
   - test-all
+  - mirror-images
   - benchmarks
 
 default:
@@ -15,6 +16,7 @@ default:
 include:
   - local: ".gitlab/build-and-test-all.yml"
   - local: ".gitlab/build-and-test-fast.yml"
+  - local: ".gitlab/mirror.yml"
 
 macrobenchmarks:
   stage: benchmarks

.gitlab/mirror.yml

@@ -0,0 +1,26 @@
+lint-mirror-images:
+  stage: mirror-images
+  # Use the docker image for its pre-configured registry auth helpers.
+  image: registry.ddbuild.io/images/docker:27.3.1
+  tags: ["arch:amd64"]
+  needs: []
+  rules:
+    - when: always
+  script:
+    - curl -LsSf https://astral.sh/uv/install.sh | sh
+    - export PATH="$HOME/.local/bin:$PATH"
+    - uv run bin/mirror_images.py lint
+
+mirror-images:
+  stage: mirror-images
+  # Use the docker image for its pre-configured registry auth helpers
+  # and crane binary for copying images.
+  image: registry.ddbuild.io/images/docker:27.3.1
+  tags: ["arch:amd64"]
+  needs: []
+  rules:
+    - when: always
+  script:
+    - curl -LsSf https://astral.sh/uv/install.sh | sh
+    - export PATH="$HOME/.local/bin:$PATH"
+    - uv run bin/mirror_images.py mirror

AGENTS.md

@@ -1,3 +1,5 @@
 # Agent Instructions
 
 `make format` to format, `make lint` to check. Rebuild formatter image after editing `Dockerfile.formatter` with `make build-formatter-image`.
+
+All public Docker images must use `registry.ddbuild.io` mirrors. Managed by `bin/mirror_images.py` (subcommands: `add`, `lock`, `relock`, `mirror`, `lint`). Config: `mirror_images.yaml` / `mirror_images.lock.yaml`. Mirror prefix: `registry.ddbuild.io/ci/nginx-datadog/mirror/`. In `build_env/Dockerfile`, `MIRROR_REGISTRY` ARG is set to `""` in GHA to use public registries.