Tag-push workflow (`on: push: tags: ['v*']`) that publishes all four
first-party images to git.adlee.work/alee/rutster-* (REGISTRY_NAMESPACE
matches the `alee` tea login per AGENTS.md Git workflow + the root
Cargo.toml's repository field). linux/amd64 only (spec §1.2 — arm64 is a
named deferral per ADR-0011).
Gating: re-runs fmt/clippy/test/deny/sim-bench as a `needs:` chain so a
tag's published image is byte-identical to the one tested by the routine
CI matrix. The fmt/clippy/test/deny re-runs are cheap on a green repo
(cache hits, fast checks), and they make a critical guarantee: the
version under a `v*` tag has ALL the repo's quality gates green at
that exact commit. Without this `needs:` chain, a tag could be pushed
at a commit where the matrix failed but image-build happened to succeed
on a flake.
Two tags per image: the version tag (github.ref_name, e.g. v0.1.0) +
`latest` (the convenience tag operators pin to).
Docker login via GITEA_REGISTRY_USERNAME + GITEA_REGISTRY_PASSWORD
secrets, set by the maintainer. If your Gitea registry uses a different
owner segment, replace `alee` throughout (REGISTRY_NAMESPACE + the
namespace/git.adlee.work/alee/ strings in .env.example + compose.yaml).
Signed-off-by: Aaron D. Lee <himself@adlee.work>
Aaron D. Lee
3aa9fa4e29