packaging: publish versioned ardur proxy OCI images to GHCR

[gnanirahulnutakki]

Parent

Child of #146. This is the container distribution stage.

Context / problem

The repository has source Dockerfiles for the proxy and hub but no public, versioned OCI publication contract. STATUS.md correctly marks OCI distribution as not public.

Acceptance criteria

• Define the supported image surface (start with the proxy) and canonical ghcr.io/ardurai/... names.
• Build amd64/arm64 images from reviewed release refs, never mutable unreviewed branch state.
• Run health plus authenticated PERMIT/DENY lifecycle tests against the built image before publication.
• Publish immutable version and digest references with minimal job permissions.
• Generate an SBOM and provenance/attestation, scan the final image, and document any accepted residual findings.
• Avoid embedded credentials, development keys, or writable root defaults; document runtime UID, volumes, ports, and TLS/auth expectations.
• Update README/STATUS only after the public digest can be pulled and verified.

Cost note

GHCR storage and egress are external operating costs. Retention for untagged/pre-release images should be bounded without deleting release digests.

[gnanirahulnutakki]

Implementation checkpoint: PR #194 is open against dev from signed commit 41183c9de92cf51cfa849ca44e07a981021da76b.

The lane now includes the hardened proxy image, hash-locked runtime dependencies, real read-only authenticated lifecycle smoke, complete SBOM/scan artifacts, exact-digest amd64/arm64 release staging, pinned max-provenance/SBOM generation, and immutable version-tag publication after both platform gates. The protected ghcr GitHub environment is configured with required review and a v* tag-only deployment policy.

Local evidence before PR CI:

• 11/11 hardened authenticated lifecycle checks passed
• exact local-registry release rehearsal passed for amd64 + arm64, attestation manifests, final manifest, digest pull, and pulled-image lifecycle
• Trivy 0.72.0: 0 secrets and 0 fixable HIGH/CRITICAL; complete unfixed residuals retained and documented
• full Python: 1348 passed, 32 skipped; Go test/vet/build passed
• Actionlint, Ruff, ShellCheck, Compose, source sync, claims, Hugo, and rendered links passed

This remains preparation, not publication. README.md/STATUS.md are unchanged and #191 stays open until a reviewed release produces a public pullable GHCR digest with independently verified manifest, attestations, and lifecycle.

[gnanirahulnutakki]

OCI/GHCR release preparation is merged to dev via #194.

Merged evidence:

• merge commit: df28eb4b1d00f6654eb4fe2c848d64d34f0d6588
• signed implementation head: 41183c9de92cf51cfa849ca44e07a981021da76b (verified ancestor of refreshed origin/dev)
• CI: 28 applicable checks passed; 6 PR-inapplicable release/deploy jobs skipped as designed
• OCI workflow validation and hardened image build/lifecycle/SBOM/scan jobs passed on GitHub
• protected ghcr environment requires review and permits only v* tags

This issue remains open because preparation is not publication. A reviewed non-prerelease vX.Y.Z release whose commit is on main must stage and scan both platform digests, create the immutable manifest, and then an owner must verify the GHCR package is public. Closure requires a credential-free digest pull plus independent confirmation of linux/amd64 + linux/arm64, SBOM/provenance attestations, health, authentication, PERMIT/DENY, signed attestation, and status/README updates. No public image is currently claimed.

[gnanirahulnutakki]

Fresh registry/release probe — 2026-07-14 00:15 CDT:

• The repository has no GitHub releases.
• Credential-free manifest lookup for ghcr.io/ardurai/ardur-proxy:v0.2.0 returns manifest unknown.
• The multi-platform build, scan, SBOM/provenance, and protected-environment preparation remains merged; publication has not occurred.

Parked dependencies: a reviewed non-prerelease tag whose commit is on main, protected-environment approval, and an owner verifying package visibility.

Resume condition: the public immutable digest is pullable without credentials. Then independently verify amd64/arm64 platforms, attestations, health/auth/PERMIT/DENY lifecycle, and update availability claims.