@starci/hfs 4.12.2 → 4.13.0

package/templates/app/ci-workflows/github/workflows/stack-deploy.yml

@@ -1,33 +1,70 @@
 {{header}}
-# Deploys the app's Docker Swarm stack. This file only assembles arguments: the logic lives in the verbs connect, build-args, deploy,
-# rollback and disconnect of "starci app stack". It runs by hand only (Actions > deploy stack > Run workflow) from a release tag v*
-# whose version is the package.json version; it has no push or schedule trigger.
-# operation deploy    builds and pushes one image per environments.<env>.deploy.images entry of .starcistacks/application-stacks.yaml,
-#                     then deploys their immutable digests (render, provision, converge, post-deploy tasks, verify, accept; a failure redeploys the previous release)
+# Deploys the app's Docker Swarm stack. This file only assembles arguments: the logic lives in the verbs connect, deploy, rollback and disconnect
+# of "starci app stack". It has two callers:
+#   ci.yml       calls it (workflow_call) once per environment with deploy.auto, after the verdict job, with the digests of the images that run
+#                pushed and the CI run that proves the commit. A green release tag deploys by itself.
+#   by hand      Actions > deploy stack > Run workflow, from a release tag v* whose version is the package.json version.
+# operation deploy    deploys the release of the tag: the immutable digests of its images (the run's, or the registry's sha-<sha> tags when
+#                     dispatched), the CI evidence of the commit, then render, store, pre-pull, migrate (expand), converge, post-deploy, verify, accept
+#                     and the contract migrations; a failure redeploys the previous accepted release
+# operation redeploy  the same, although the accepted release already runs this commit
 # operation rollback  redeploys a stored release; "release" is 16 lowercase hex characters, empty means the previous accepted release
-# The environment input names a protected GitHub environment (required reviewers) that holds:
-#   vars    VPS_HOST, VPS_USER (the swarm manager); a variable named in deploy.passEnv, when the stack interpolates one
+# The environment names a GitHub environment whose deployment refs are restricted to the tags v* and that holds:
+#   vars    STARCI_DEPLOY_PAUSED (true stops the automatic deploy of that environment without a code change; a manual run still works), and a
+#           variable named in deploy.passEnv when the stack interpolates one
 #   secrets SOPS_AGE_KEY (that environment's server identity, stored there by starci app secret server-key --env <env> --backup github --execute;
-#           both jobs are bound to the environment, so they read it and never a repository secret of that name), VPS_SSH_KEY
-#           (CI-only deploy key), VPS_KNOWN_HOSTS (pinned host keys)
-# Nothing else is a secret: images are pushed with the workflow token, which also reads the CI verdict of the tag's commit a production deploy
-# waits for (requireCi deploy.prod). Dispatch inputs reach scripts only through env.
+#           the jobs are bound to the environment, so they read it and never a repository secret of that name)
+# The transport is sealed: the CI deploy key, the pinned host keys and the host are the member vps-ci under .starcistacks/<env>/secrets, opened with
+# the server identity (a key of its own, never the owner's, authorised on the manager with a forced command). Nothing else is a secret: the images
+# are read with the workflow token. Inputs reach scripts only through env. The log of a public repository is public: no step prints a host or a path.
 name: deploy stack
 
 on:
+  workflow_call:
+    inputs:
+      environment:
+        description: GitHub environment holding the server identity and the sealed custody under .starcistacks
+        required: true
+        type: string
+      operation:
+        description: deploy, redeploy or rollback
+        required: false
+        type: string
+        default: deploy
+      release:
+        description: "Rollback only: release id (16 lowercase hex) to deploy again; empty means the previous accepted release"
+        required: false
+        type: string
+        default: ""
+      images:
+        description: "JSON object, service -> repository@sha256:digest of the images the calling run pushed; empty reads the registry's sha-<sha> tags"
+        required: false
+        type: string
+        default: ""
+      ci_run:
+        description: Id of the CI run that proves the commit; empty finds the green CI run of the commit
+        required: false
+        type: string
+        default: ""
+      auto:
+        description: The automatic deploy of a green release tag (it stops when STARCI_DEPLOY_PAUSED is true)
+        required: false
+        type: boolean
+        default: false
   workflow_dispatch:
     inputs:
       environment:
-        description: Protected environment holding the VPS variables and the sealed custody under .starcistacks
+        description: GitHub environment holding the server identity and the sealed custody under .starcistacks
         required: true
         type: environment
       operation:
-        description: Deploy a new release or roll back to a stored one
+        description: Deploy the release of this tag, deploy it again, or roll back to a stored release
         required: true
         type: choice
         default: deploy
         options:
           - deploy
+          - redeploy
           - rollback
       release:
         description: "Rollback only: release id (16 lowercase hex) to deploy again; empty means the previous accepted release"
@@ -38,69 +75,125 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: stack-${{ inputs.environment }}
-  cancel-in-progress: false
-
 jobs:
-  release:
-    if: ${{ inputs.operation == 'deploy' }}
+  deploy:
+    if: ${{ inputs.operation != 'rollback' }}
     runs-on: ubuntu-latest
     environment: ${{ inputs.environment }}
     timeout-minutes: 60
     permissions:
       contents: read
-      packages: write
+      packages: read
       actions: read
+    concurrency:
+      group: stack-${{ inputs.environment }}
+      cancel-in-progress: false
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
     steps:{{stackGuard}}
       - name: require release tag
         shell: bash
         run: '[[ "$GITHUB_REF" == refs/tags/v* ]] || exit 1'
+      - name: deploy pause
+        id: pause
+        shell: bash
+        env:
+          AUTO: ${{ inputs.auto }}
+          PAUSED: ${{ vars.STARCI_DEPLOY_PAUSED }}
+        run: |
+          if [[ "$AUTO" == true && "$PAUSED" == true ]]; then
+            echo "paused=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::STARCI_DEPLOY_PAUSED is true for this environment: this release was not deployed"
+            echo "### Deploy paused" >> "$GITHUB_STEP_SUMMARY"
+            echo "STARCI_DEPLOY_PAUSED is true for this environment, so the automatic deploy was skipped. Run this workflow by hand to deploy the release." >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "paused=false" >> "$GITHUB_OUTPUT"
+          fi
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        if: ${{ steps.pause.outputs.paused != 'true' }}
       - name: release tag matches package version
+        if: ${{ steps.pause.outputs.paused != 'true' }}
         run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        if: ${{ steps.pause.outputs.paused != 'true' }}
         with:
           node-version: {{nodeMajor}}
           cache: npm
       - run: npm ci --ignore-scripts
+        if: ${{ steps.pause.outputs.paused != 'true' }}
       - name: install SOPS
+        if: ${{ steps.pause.outputs.paused != 'true' }}
         uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
         with:
           version: v3.13.2
-      - name: image repositories
-        id: names
-        shell: bash
-        run: |
-          owner="${GITHUB_REPOSITORY_OWNER,,}"{{stackNames}}
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        if: ${{ steps.pause.outputs.paused != 'true' }}
       - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        if: ${{ steps.pause.outputs.paused != 'true' }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ github.token }}{{stackImageSteps}}
+          password: ${{ github.token }}
+      - name: image digests
+        id: images
+        if: ${{ steps.pause.outputs.paused != 'true' }}
+        shell: bash
+        env:
+          IMAGES: ${{ inputs.images }}
+        run: |
+          set -euo pipefail
+          owner="${GITHUB_REPOSITORY_OWNER,,}"
+          [[ -n "$IMAGES" ]] || IMAGES='{}'
+          while read -r service app; do
+            ref=$(jq -r --arg service "$service" '.[$service] // empty' <<<"$IMAGES")
+            if [[ -z "$ref" ]]; then
+              repo="ghcr.io/${owner}/{{project}}-${app}"
+              digest=$(docker buildx imagetools inspect "$repo:sha-$GITHUB_SHA" --format '{{json .Manifest}}' | jq -r .digest)
+              ref="${repo}@${digest}"
+            fi
+            [[ "$ref" =~ ^ghcr\.io/[a-z0-9._/-]+@sha256:[0-9a-f]{64}$ ]] || { echo "::error::no immutable image for ${service}"; exit 1; }
+            echo "${service}=${ref}" >> "$GITHUB_OUTPUT"
+          done <<'LIST'
+          {{stackImageList}}
+          LIST
+      - name: CI run of the commit
+        id: ci
+        if: ${{ steps.pause.outputs.paused != 'true' }}
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          CI_RUN: ${{ inputs.ci_run }}
+        run: |
+          set -euo pipefail
+          if [[ -z "$CI_RUN" ]]; then
+            CI_RUN=$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/ci.yml/runs?head_sha=${GITHUB_SHA}&event=push&status=success&per_page=100" --jq '[.workflow_runs[].id] | first // empty')
+          fi
+          [[ "$CI_RUN" =~ ^[1-9][0-9]*$ ]] || { echo "::error::no green CI run of this commit: a release deploys only a commit the CI proved"; exit 1; }
+          echo "run=$CI_RUN" >> "$GITHUB_OUTPUT"
       - name: connect to the swarm manager
+        if: ${{ steps.pause.outputs.paused != 'true' }}
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
-          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
-          VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
-          VPS_HOST: ${{ vars.VPS_HOST }}
-          VPS_USER: ${{ vars.VPS_USER }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: deploy the release
+        if: ${{ steps.pause.outputs.paused != 'true' }}
+        shell: bash
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           GH_TOKEN: ${{ github.token }}
-          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+          OPERATION: ${{ inputs.operation }}
+          CI_RUN: ${{ steps.ci.outputs.run }}{{stackImageEnv}}{{stackPassEnv}}
         run: |
+          again=()
+          [[ "$OPERATION" != redeploy ]] || again=(--redeploy)
           npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}
-            --sha "$GITHUB_SHA" --execute
+            --sha "$GITHUB_SHA" --ci-run "$CI_RUN" "${again[@]}" --execute
       - name: disconnect from the swarm manager
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
-        if: ${{ always() }}
+        if: ${{ always() && steps.pause.outputs.paused != 'true' }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute
 
   rollback:
@@ -111,6 +204,9 @@ jobs:
     permissions:
       contents: read
       packages: read
+    concurrency:
+      group: stack-${{ inputs.environment }}
+      cancel-in-progress: false
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
     steps:
@@ -137,10 +233,7 @@ jobs:
       - name: connect to the swarm manager
         env:
           XDG_DATA_HOME: ${{ runner.temp }}/starci-data
-          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
-          VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
-          VPS_HOST: ${{ vars.VPS_HOST }}
-          VPS_USER: ${{ vars.VPS_USER }}
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: redeploy the stored release
         env:

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -1,25 +1,85 @@
 {{header}}
 name: ci
 
-# CI judges main, release candidates and release tags.
+# CI judges pull requests, main, release candidates and release tags, and a green release tag deploys.
+#   pull_request  the checks and the image builds of a change to main, with no secret and no environment (a Dependabot or fork run has none anyway);
+#                 and no run of this workflow executes a pull request's code with a token that can write
+#   main          judged only when no release tag points at the pushed commit (the release push sends main and its tag together; the tag run is the release run)
+#   candidate     release/candidate-<version>: the full run of a release the tag run then reuses
+#   tag v*        the release run: plan, checks and images in parallel, the verdict, then the deploy of every environment with deploy.auto
 on:
   push:
     branches: ["main", "release/candidate-*"]
     tags: ["v*"]
+  pull_request:
+    branches: ["main"]
   workflow_dispatch:
 
 permissions:
   contents: read
 
-# One run per ref: a release tag is never cancelled by another run.
+# The committed check cache (.starcistacks/cache, contexts/project/check-cache.md): a run judges only what differs from the cache at its trusted base
+# (the first parent of a push to main). A release candidate and a release tag judge in full and never read the cache.
+env:
+  STARCI_APP_CHECK_CACHE: ${{ (startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/release/candidate-')) && 'full' || '' }}
+
+# One run per ref. A pull request run is replaced by the next push to it; every other run, a release tag above all, is never cancelled.
 concurrency:
   group: ci-${{ github.ref }}
-  cancel-in-progress: false
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-# The job shape of the StarCi CI standard (knowledge/hfs/ci-standard.yaml): fast, lint per side, the unit run in shards, one coverage merge, build,
-# and sonar. Timeouts and the shard count come from ci.jobs of .starcistacks/application-stacks.yaml (defaults in the standard).
+# The job shape of the StarCi CI standard (knowledge/hfs/ci-standard.yaml): plan, fast, lint per side, the unit run in shards, one coverage merge, build, images,
+# sonar, the verdict and the deploy jobs. Timeouts and the shard count come from ci.jobs of .starcistacks/application-stacks.yaml (defaults in the standard).
+# A job the plan leaves out is never a green one: the verdict job requires every job it needs to be green or, where the plan left it out on purpose, not run.
 jobs:
+  plan:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      checks: ${{ steps.plan.outputs.checks }}
+      images: ${{ steps.plan.outputs.images }}
+      push: ${{ steps.plan.outputs.push }}
+      full: ${{ steps.plan.outputs.full }}
+      release: ${{ steps.plan.outputs.release }}
+      ci_run: ${{ steps.plan.outputs.ci_run }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+      - name: plan
+        id: plan
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT: ${{ github.event_name }}
+          REF_TYPE: ${{ github.ref_type }}
+        run: |
+          set -euo pipefail
+          checks=true images=true push=false full=false release=false ci_run="$GITHUB_RUN_ID" note="checks and image builds"
+          if [[ "$EVENT" == push ]]; then
+            full=true push=true
+            if [[ "$REF_TYPE" == tag ]]; then
+              release=true
+              [[ "$GITHUB_REF_NAME" == "v$(node -p "require('./package.json').version")" ]] || { echo "::error::the release tag does not match the package version"; exit 1; }
+              reused=$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/ci.yml/runs?head_sha=${GITHUB_SHA}&event=push&status=success&per_page=100" --jq '[.workflow_runs[] | select(.head_branch | startswith("release/candidate-"))] | first | .id // empty')
+              if [[ -n "$reused" ]]; then checks=false ci_run="$reused" note="release run: the green candidate run $reused judged this commit; images are built and pushed here"; else note="release run: full checks and images"; fi
+            elif [[ "$GITHUB_REF" == refs/heads/release/candidate-* ]]; then
+              note="candidate run: full checks; images are built and pushed under sha-<sha>"
+            elif [[ -n "$(git tag --points-at "$GITHUB_SHA" --list 'v*')" ]]; then
+              checks=false images=false push=false full=false note="deferred: the release tag run of this commit judges it"
+            else
+              images=false push=false full=false note="main without a release tag: checks only"
+            fi
+          fi
+          { echo "checks=$checks"; echo "images=$images"; echo "push=$push"; echo "full=$full"; echo "release=$release"; echo "ci_run=$ci_run"; } >> "$GITHUB_OUTPUT"
+          echo "plan: $note" >> "$GITHUB_STEP_SUMMARY"
+
   fast:
+    needs: plan
+    if: ${{ needs.plan.outputs.checks == 'true' }}
     timeout-minutes: {{timeoutFast}}
     runs-on: ubuntu-latest
     steps:
@@ -27,13 +87,15 @@ jobs:
       - name: production dependency audit
         run: {{auditCommand}}
       - name: format
-        run: npm run format:check
+        run: npx --no-install starci app check --format
       - name: typecheck
         run: npm run typecheck
         env:
           NODE_OPTIONS: {{nodeOptions}}
 
   lint:
+    needs: plan
+    if: ${{ needs.plan.outputs.checks == 'true' }}
     timeout-minutes: {{timeoutLint}}
     runs-on: ubuntu-latest
     strategy:
@@ -46,6 +108,8 @@ jobs:
 {{ciLintSteps}}
 
   test:
+    needs: plan
+    if: ${{ needs.plan.outputs.checks == 'true' }}
     timeout-minutes: {{timeoutTest}}
     runs-on: ubuntu-latest
     strategy:
@@ -69,7 +133,7 @@ jobs:
           path: {{shardCoverageReport}}
 
   coverage:
-    needs: test
+    needs: [plan, test]
     timeout-minutes: {{timeoutCoverage}}
     runs-on: ubuntu-latest
     # Codecov OIDC authentication requires a job-scoped identity token.
@@ -96,6 +160,8 @@ jobs:
 {{codecovSteps}}
 
   build:
+    needs: plan
+    if: ${{ needs.plan.outputs.checks == 'true' }}
     timeout-minutes: {{timeoutBuild}}
     runs-on: ubuntu-latest
     steps:
@@ -110,3 +176,44 @@ jobs:
           NODE_OPTIONS: {{nodeOptions}}
 
 {{sonarJob}}
+  images:
+    needs: plan
+    if: ${{ needs.plan.outputs.images == 'true' }}
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/images.yml
+    with:
+      push: ${{ needs.plan.outputs.push == 'true' }}
+      release: ${{ needs.plan.outputs.release == 'true' }}
+
+  verdict:
+    needs: [plan, fast, lint, test, coverage, build, images{{verdictSonarNeed}}]
+    if: ${{ always() }}
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: verdict
+        shell: bash
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+          CHECKS: ${{ needs.plan.outputs.checks }}
+          IMAGES: ${{ needs.plan.outputs.images }}
+          FULL: ${{ needs.plan.outputs.full }}
+        run: |
+          set -euo pipefail
+          fail=0
+          expect() {
+            got=$(jq -r --arg job "$1" '.[$job].result' <<<"$NEEDS")
+            case "$2" in
+              success) [[ "$got" == success ]] || { echo "::error::job $1 is $got, expected success"; fail=1; } ;;
+              idle) [[ "$got" != success && "$got" != failure && "$got" != cancelled ]] || { echo "::error::job $1 ran ($got) where the plan left it out"; fail=1; } ;;
+            esac
+          }
+          expect plan success
+          if [[ "$CHECKS" == true ]]; then want=success; else want=idle; fi
+          for job in fast lint test coverage build; do expect "$job" "$want"; done
+          if [[ "$IMAGES" == true ]]; then expect images success; else expect images idle; fi{{verdictSonarCheck}}
+          exit "$fail"
+{{ciDeployJobs}}

package/templates/app/ci-workflows-lite/github/workflows/images.yml

@@ -1,74 +1,30 @@
 {{header}}
-# Builds each image declared by the lite app. The API image is required; a front-end image is emitted only when declared.
-# It runs on the release tag, so every image is built there, and never pushes.
-# When an environment declares images, the job is bound to that protected GitHub environment and opens its sealed build
-# arguments with that environment's SOPS_AGE_KEY (its server identity, starci app secret server-key --env <env> --backup github --execute).
+# Builds every image the app declares, once per commit, and pushes the deployed ones to GHCR. ci.yml calls it next to the checks, so the images
+# are built in parallel with them and a Dockerfile that no longer builds fails the same run. It has no trigger of its own.
+#   tags       sha-<sha> on every push; the release tag v<version> is added on a release run by retagging that digest (no rebuild), so the
+#              image the checks ran beside is the image that ships. No mutable environment tag is ever written or deployed.
+#   evidence   an SBOM and provenance (mode=max) are attached to the pushed digest; a build that is not pushed only proves the Dockerfile builds.
+#   values     build arguments are public values (the browser receives them); a secret never enters an image build.
+#   sealed     an image whose public build values live in a sealed member is built by the job bound to the release environment, on a release
+#              tag run only (that environment is restricted to v* tags); every other image builds without an environment or a secret.
+# The workflow is read by anyone when the repository is public: it runs on GitHub-hosted runners only, and nothing it prints names a host.
 name: images
 
 on:
-  push:
-    tags: ["v*"]
+  workflow_call:
+    inputs:
+      push:
+        description: Push the deployed images (a push run); a pull request or a manual run only builds them
+        required: true
+        type: boolean
+      release:
+        description: A release tag run - also tag the pushed images v<version> and build the images that open sealed build values
+        required: true
+        type: boolean
+{{imageWorkflowOutputs}}
 
 permissions:
   contents: read
 
-# One run per ref.
-concurrency:
-  group: images-${{ github.ref }}
-  cancel-in-progress: false
-
 jobs:
-  image:
-    timeout-minutes: 30
-    runs-on: ubuntu-latest{{imageJobEnvironment}}
-    env:
-      STACK_ENVIRONMENT: {{imageEnvironment}}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-{{imageMatrix}}
-    steps:{{imageEnvironmentGuard}}
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - name: release tag matches package version
-        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        if: {{imageBuildArgsIf}}
-        with:
-          node-version: {{nodeMajor}}
-          cache: npm
-      - run: npm ci --ignore-scripts
-        if: {{imageBuildArgsIf}}
-      - name: install SOPS
-        if: {{imageBuildArgsIf}}
-        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
-        with:
-          version: v3.13.2
-      - name: public build values
-        id: args
-        if: {{imageBuildArgsIf}}
-        env:
-          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
-          IMAGE_APP: ${{ matrix.name }}
-        run: npx --no-install starci app stack build-args --env "$STACK_ENVIRONMENT" --app "$IMAGE_APP"
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
-        with:
-          context: .
-          file: ${{ matrix.file }}
-          build-args: ${{ steps.args.outputs.args }}
-          push: false
-          tags: {{imageProject}}/${{ matrix.name }}:${{ github.ref_name }}
-          # OCI keeps the SBOM and provenance attestations without publishing to a registry.
-          outputs: type=oci,dest=${{ runner.temp }}/${{ matrix.name }}.oci.tar
-          sbom: true
-          provenance: mode=max
-          cache-from: type=gha,scope=${{ matrix.name }}
-          cache-to: type=gha,scope=${{ matrix.name }},mode=max
-      - name: retain image with SBOM and provenance
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: image-${{ matrix.name }}-${{ github.sha }}-${{ github.run_attempt }}
-          path: ${{ runner.temp }}/${{ matrix.name }}.oci.tar
-          if-no-files-found: error
-          compression-level: 0
+{{imageJobs}}