create-freeholder 0.0.0-bootstrap.0 → 0.2.0-beta.2

package/dist/template/.github/workflows/ci.yml

@@ -0,0 +1,501 @@
+# Copyright (C) 2026 Tony Aly
+# SPDX-License-Identifier: Apache-2.0
+# Independent required jobs keep first feedback below the owned CI SLO while
+# the final release gate still represents every test and deploy proof.
+name: CI
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  SESSION_SECRET: ci-build-only-not-a-real-secret-0000000000
+
+jobs:
+  mobile:
+    name: Customer app
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .node-version
+      # Fail closed on the demo contract, init's store assets and the privacy
+      # manifest before paying for a React Native install. Signed store
+      # binaries still need EAS credentials; this job does not start one.
+      - name: Validate demo contract, store assets and privacy
+        run: node scripts/mobile-store-gate.mjs
+      - name: Host update refusal and recovery drills
+        run: python3 -m unittest discover -s tests/host -v
+      # `npm ci` inside apps/mobile, not the workspace install. The app sits
+      # outside the root pnpm workspace on purpose: a React Native dependency
+      # graph that only this app needs must not be billed to every other job.
+      - name: Install the customer app
+        working-directory: apps/mobile
+        run: npm ci --no-audit --no-fund
+      - name: Typecheck the customer app
+        working-directory: apps/mobile
+        run: npx tsc -p tsconfig.json --noEmit
+      - name: Bundle both native platforms
+        working-directory: apps/mobile
+        run: npx expo export --platform android --platform ios
+      - name: Signed store binaries need EAS credentials
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        run: |
+          if [ -n "$EXPO_TOKEN" ]; then
+            echo "EXPO_TOKEN is present. This job still does not start eas build — a pull request must not spend EAS quota. Dispatch .github/workflows/eas.yml to produce signed store binaries."
+            exit 0
+          fi
+          echo "No EAS credentials in this environment. CI already exported iOS and Android bundles and gated the demo contract, store assets and privacy manifest. Signed store-submittable binaries need an Expo account and Apple/Google credentials via EAS."
+
+  application:
+    name: Application gates
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: ./.github/actions/setup-project
+      - run: pnpm plan:check
+      - run: pnpm license:check
+      - run: pnpm workflow:check
+      - run: pnpm lint
+      - run: pnpm typecheck
+      - name: Published package artifact integrity
+        run: pnpm packages:verify
+      - run: pnpm build
+      - run: pnpm artifact:check
+      - name: Schema compatibility
+        if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
+        env:
+          SCHEMA_BASE: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || 'origin/main' }}
+        run: node scripts/schema-compat-gate.mjs "$SCHEMA_BASE"
+      - name: Changelog coverage
+        if: github.event_name == 'pull_request'
+        run: node scripts/changelog-gate.mjs origin/${{ github.base_ref }}
+
+  security:
+    name: Security and dependency evidence
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Dependency change review
+        if: github.event_name == 'pull_request'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: low
+          # `image-size` reaches the tree only through Metro — React Native's
+          # bundler — via @react-native/community-cli-plugin and metro-config.
+          # It reads image dimensions while bundling on a developer machine or
+          # in CI; it is never on a customer's phone, so the denial of service
+          # needs somebody to bundle a malicious JXL/HEIF/ICNS image of their
+          # own. Every published version is affected, so unlike the pnpm
+          # overrides above there is no patch to take.
+          #
+          # Two named advisories, not a path exemption: every other advisory in
+          # the mobile app's ~600 packages still fails this build at severity
+          # low, including any that would reach a device. Delete these the day
+          # upstream publishes a fix.
+          allow-ghsas: GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c # v3.97.4
+        with:
+          # TruffleHog infers ranges for pull_request and push, but not for
+          # merge_group. Keep every required event on an explicit immutable
+          # before/after range so a queue run neither misses its merge commit
+          # nor silently falls back to scanning unrelated repository history.
+          base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'merge_group' && github.event.merge_group.base_sha || github.event.before }}
+          head: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event_name == 'merge_group' && github.event.merge_group.head_sha || github.sha }}
+          version: 3.97.4
+          extra_args: --results=verified,unknown --fail-on-scan-errors
+      # Run repository scanners before executing any dependency lifecycle from
+      # a pull request. This job has no write permission in either phase.
+      - uses: ./.github/actions/setup-project
+      - name: Live dependency audit
+        run: node scripts/dependency-audit.mjs --write-attestation=artifacts/dependency-audit.json
+      - name: Preserve lockfile-keyed audit evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dependency-audit-${{ github.sha }}
+          path: artifacts/dependency-audit.json
+          if-no-files-found: error
+          retention-days: 30
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+      - name: Analyze with CodeQL
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+
+  tests:
+    name: Tests (${{ matrix.shard }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        # vitest.config.ts uses the runtime-balanced sequencer. Twenty-three
+        # isolated databases keep the 25-minute limit safe even when one hosted
+        # runner executes DB-backed files at the measured 6.7x degraded rate.
+        # The sequencer integrity test binds this topology to that resilience
+        # budget. C11.13 added shards rather than raising the timeout.
+        shard:
+          - 1/24
+          - 2/24
+          - 3/24
+          - 4/24
+          - 5/24
+          - 6/24
+          - 7/24
+          - 8/24
+          - 9/24
+          - 10/24
+          - 11/24
+          - 12/24
+          - 13/24
+          - 14/24
+          - 15/24
+          - 16/24
+          - 17/24
+          - 18/24
+          - 19/24
+          - 20/24
+          - 21/24
+          - 22/24
+          - 23/24
+          - 24/24
+    services:
+      postgres:
+        image: postgres:16@sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: freeholder_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready --health-interval 5s
+          --health-timeout 5s --health-retries 10
+    env:
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/freeholder_test
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          # C10.19 identity applies the pre-collapse chain from the parent of
+          # the commit that deleted 0000_core-spine.sql. Depth 1 cannot see it.
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-project
+      - run: pnpm exec vitest run --shard=${{ matrix.shard }}
+
+  ownership:
+    name: Backup, restore and export drill
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:16@sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: freeholder_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready --health-interval 5s
+          --health-timeout 5s --health-retries 10
+    env:
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/freeholder_test
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-project
+      - run: pnpm ownership:drill
+
+  browser:
+    name: Browser accessibility and journeys
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:16@sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: freeholder_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready --health-interval 5s
+          --health-timeout 5s --health-retries 10
+    env:
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/freeholder_test
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-project
+      - run: pnpm build
+      - run: pnpm exec playwright install --with-deps chromium
+      - run: pnpm test:browser
+
+  deployment:
+    name: Image, recipes, public gates and upgrade
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions:
+      contents: read
+      packages: read
+    services:
+      postgres:
+        image: postgres:16@sha256:f1c3376c26f2609ab9f29f71f824103fe2fcd8ee0346485cb6122a4f93df6f94
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: freeholder_test
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd pg_isready --health-interval 5s
+          --health-timeout 5s --health-retries 10
+    env:
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/freeholder_test
+      PGHOST: localhost
+      PGUSER: postgres
+      PGPASSWORD: postgres
+      CI_IMAGE: freeholder:ci
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-project
+      - name: Build the release image
+        run: docker build --tag freeholder:ci .
+      - name: Prove the isolated public playground boots and signs in
+        run: sh scripts/playground-gate.sh
+      - name: Prove dependency failure separates liveness from readiness
+        run: |
+          cleanup() { docker rm -f freeholder-outage >/dev/null 2>&1 || true; }
+          trap cleanup EXIT
+          docker run -d --name freeholder-outage --network host \
+            -e PORT=3001 \
+            -e SESSION_SECRET=ci-only-secret-that-is-32-chars-long \
+            -e APP_URL=http://localhost:3001 \
+            -e DATABASE_URL=postgres://postgres:postgres@127.0.0.1:59999/unavailable \
+            freeholder:ci
+          live=""
+          for _ in $(seq 1 60); do
+            live=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/health/live || true)
+            [ "$live" = "200" ] && break
+            sleep 1
+          done
+          [ "$live" = "200" ] || {
+            docker logs freeholder-outage
+            echo "liveness answered $live during dependency failure, expected 200"
+            exit 1
+          }
+          ready=$(curl --max-time 8 -s -o /dev/null -w '%{http_code}' http://localhost:3001/api/health || true)
+          [ "$ready" = "503" ] || {
+            docker logs freeholder-outage
+            echo "readiness answered $ready during dependency failure, expected 503"
+            exit 1
+          }
+      - name: Prove the image boots its real request graph
+        run: |
+          docker run -d --name freeholder-ci --network host \
+            -e SESSION_SECRET=ci-only-secret-that-is-32-chars-long \
+            -e APP_URL=http://localhost:3000 \
+            -e DATABASE_URL="$DATABASE_URL" freeholder:ci
+          code=""
+          for _ in $(seq 1 90); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/health || true)
+            [ "$code" = "200" ] && break
+            sleep 1
+          done
+          if [ "$code" != "200" ]; then
+            docker logs freeholder-ci
+            echo "readiness answered $code, expected 200"
+            exit 1
+          fi
+          health=$(curl -fsS http://localhost:3000/api/health)
+          node -e '
+            const h = JSON.parse(process.argv[1]);
+            if (!h.ok || !h.modules || !h.services || !h.jobs?.ready) {
+              console.error("incomplete boot evidence", h); process.exit(1);
+            }
+            console.log(`booted ${h.modules} modules, ${h.services} services, ${h.listeners} listeners; worker age ${h.jobs.heartbeatAgeSeconds}s`);
+          ' "$health"
+          test "$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/)" = "200"
+          test "$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/setup)" = "200"
+          docker rm -f freeholder-ci >/dev/null
+      # Pulled from our own registry, not from upstream. MinIO closed public
+      # distribution in September 2026 — quay.io and Docker Hub both answer 401
+      # to an anonymous read and bitnami/minio was emptied — so a build that
+      # pulled it went red for a licensing decision with nothing wrong in it.
+      # `.github/workflows/mirror-ci-images.yml` owns the mirror.
+      #
+      # The replacement is adobe/s3mock rather than another MinIO build, because
+      # no MinIO build is still freely distributable. What the gate exercises is
+      # unchanged: Doctor writes, reads and deletes a real object over signed
+      # path-style HTTP through our own aws4fetch adapter. What is no longer
+      # exercised is credential enforcement — s3mock accepts any key — so a
+      # signing regression would now surface in deployment rather than here.
+      - name: Log in to ghcr.io for the mirrored CI images
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Start S3-compatible recipe storage
+        env:
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          # Lower-cased because ghcr.io rejects a mixed-case repository
+          # name, and `github.repository_owner` is spelled as the account is.
+          image="ghcr.io/$(echo "$OWNER" | tr '[:upper:]' '[:lower:]')/freeholder-ci-s3:5.2.3@sha256:ab01a6946750f451ca215a47e91030695b260e4003b8a5a6201d25029b8fca92"
+          # Published rather than host-networked: s3mock serves HTTP on 9090 and
+          # offers no port override, and recipe-matrix.sh expects 9000.
+          docker run -d --name freeholder-s3 -p 127.0.0.1:9000:9090 \
+            -e COM_ADOBE_TESTING_S3MOCK_STORE_INITIAL_BUCKETS=freeholder-recipe-gate \
+            -e COM_ADOBE_TESTING_S3MOCK_STORE_REGION=us-east-1 \
+            "$image"
+          # The bucket arrives with the container, so there is no second image
+          # and no client to install. Waited on by listing it: a container that
+          # is up before its bucket exists fails the gate further along, where
+          # it reads as a storage bug in Freeholder rather than a race here.
+          ready=''
+          for _ in $(seq 1 60); do
+            if curl -fsS -o /dev/null http://127.0.0.1:9000/freeholder-recipe-gate; then
+              ready=yes
+              break
+            fi
+            sleep 1
+          done
+          if [ -z "$ready" ]; then
+            docker logs freeholder-s3
+            echo 'the recipe-gate bucket never became readable'
+            exit 1
+          fi
+      - run: bash scripts/recipe-matrix.sh
+      - run: bash scripts/public-gates.sh
+      - name: Registry login for the previous release
+        continue-on-error: true
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Upgrade from the previous release
+        run: bash scripts/upgrade-gate.sh
+        env:
+          PREVIOUS_IMAGE: ghcr.io/${{ github.repository }}:edge
+          CURRENT_IMAGE: freeholder:ci
+
+  release-gate:
+    # Keep the existing protected-branch context while changing its meaning
+    # from one serial job to the fan-in of every independent required job.
+    # GitHub treats a skipped required check as success, so this job must run
+    # after a failed dependency and fail closed. Otherwise a red shard skips
+    # `checks` and the merge queue lands the candidate (merge-group 33993046449).
+    name: checks
+    if: ${{ always() }}
+    needs: [mobile, application, security, codeql, tests, ownership, browser, deployment]
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Fail unless every required gate succeeded
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+        run: |
+          echo "$NEEDS"
+          echo "$NEEDS" | jq -e 'all(.[]; .result == "success")'
+
+  candidate-image:
+    name: Build attested release candidate
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: release-gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - id: image
+        name: Normalize the image name
+        run: |
+          image="ghcr.io/${GITHUB_REPOSITORY,,}"
+          echo "IMAGE=$image" >> "$GITHUB_ENV"
+          echo "name=$image" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: build
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.image.outputs.name }}:candidate-${{ github.sha }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          platforms: linux/amd64
+          provenance: false
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Attest candidate build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-name: ${{ steps.image.outputs.name }}
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+      - name: Record the exact promotable artifact
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          mkdir -p artifacts
+          jq -n \
+            --arg schema "freeholder/image-candidate/v1" \
+            --arg sha "$GITHUB_SHA" \
+            --arg image "$IMAGE" \
+            --arg digest "$DIGEST" \
+            '{schema: $schema, sha: $sha, image: $image, digest: $digest}' \
+            > artifacts/image-candidate.json
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: image-candidate-${{ github.sha }}
+          path: artifacts/image-candidate.json
+          if-no-files-found: error
+          retention-days: 30

package/dist/template/.github/workflows/eas.yml

@@ -0,0 +1,51 @@
+# Copyright (C) 2026 Tony Aly
+# SPDX-License-Identifier: Apache-2.0
+# Signed iOS/Android binaries. Not a required check: EAS needs Expo, Apple
+# and Google credentials this repository does not store, and a pull request
+# must not spend EAS quota. Dispatch this workflow when those credentials
+# exist. CI already exports both native bundles and gates the demo contract.
+name: EAS store binaries
+
+on:
+  workflow_dispatch:
+    inputs:
+      platform:
+        description: Native platform to build
+        type: choice
+        default: all
+        options: [all, ios, android]
+
+permissions:
+  contents: read
+
+jobs:
+  eas:
+    name: Signed store binaries
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .node-version
+      - name: Require Expo credentials
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        run: |
+          if [ -z "$EXPO_TOKEN" ]; then
+            echo "EXPO_TOKEN is not configured. Signed store binaries need an Expo account and Apple/Google credentials via EAS."
+            echo "CI already exported iOS/Android bundles and gated the demo contract, store assets and privacy manifest."
+            exit 1
+          fi
+      - name: Install the customer app
+        working-directory: apps/mobile
+        run: npm ci --no-audit --no-fund
+      - name: Validate demo contract, store assets and privacy
+        run: node scripts/mobile-store-gate.mjs
+      - name: Start the EAS production build
+        working-directory: apps/mobile
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+        run: npx --yes eas-cli build --platform "${{ inputs.platform }}" --profile production --non-interactive --no-wait

package/dist/template/.github/workflows/mirror-ci-images.yml

@@ -0,0 +1,62 @@
+# Copyright (C) 2026 Tony Aly
+# SPDX-License-Identifier: Apache-2.0
+# Mirror the third-party images CI depends on into this repository's own
+# registry.
+#
+# CI used to pull its S3-compatible storage straight from quay.io. In September
+# 2026 MinIO closed public distribution: `quay.io/minio/minio` answers 401 to an
+# anonymous manifest read, `minio/minio` on Docker Hub answers 401 even with a
+# valid anonymous pull token, and `bitnami/minio` was emptied of every tag. A
+# green build stopped being reproducible because of somebody else's licensing
+# decision, which is the failure this workflow exists to prevent recurring.
+#
+# So CI reads from ghcr.io, and the only place that touches an upstream registry
+# is this workflow. Mirroring is a deliberate act with a commit behind it rather
+# than something every build does sixty times a day.
+name: Mirror CI images
+
+on:
+  push:
+    paths: [".github/workflows/mirror-ci-images.yml"]
+  workflow_dispatch:
+
+concurrency:
+  group: mirror-ci-images
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    name: Mirror into ghcr.io
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Log in to ghcr.io
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      # Copied by digest, not by tag, and `imagetools create` copies the whole
+      # manifest list rather than one architecture. The destination tag names
+      # the upstream version so the mirror is auditable from the tag alone.
+      - name: Mirror the S3-compatible storage used by the recipe gate
+        env:
+          SOURCE: docker.io/adobe/s3mock:5.2.3@sha256:ab01a6946750f451ca215a47e91030695b260e4003b8a5a6201d25029b8fca92
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          # Lower-cased because ghcr.io rejects a mixed-case repository name and
+          # `github.repository_owner` is spelled the way the account is.
+          target="ghcr.io/$(echo "$OWNER" | tr '[:upper:]' '[:lower:]')/freeholder-ci-s3:5.2.3"
+          docker buildx imagetools create --tag "$target" "$SOURCE"
+          echo "Mirrored $SOURCE to $target"
+          docker buildx imagetools inspect "$target" --format '{{ .Manifest.Digest }}'