ci: build once, gate the digest, promote what was tested (RT#1550)

.gemini/styleguide.md

@@ -21,9 +21,8 @@
 
 ## CI
 - Workflows MUST include weekly cron trigger for base image security updates
-- Build caching is MANDATORY: `cache-from: type=gha` / `cache-to: type=gha,mode=max`
-- Set `no-cache` only on non-commit builds (`schedule`, `repository_dispatch`, `workflow_dispatch`); never on `push` or `pull_request` builds
-- Dual-push (Quay + GHCR) uses two separate jobs, not steps
+- Container builds go through `crunchtools/constitution/.github/workflows/container-release.yml`: build once per change, gate the digest, promote by `skopeo copy --all --preserve-digests`. Outside the repos listed in `container_release_custom` (profiles/requirements.toml), flag any job that publishes an image (`push`, `skopeo copy`, `docker/build-push-action` with push) or moves `:latest`/`:main`; a local build that is never pushed (an integration-test image) is fine. Everywhere, flag `imagetools create` and a `ghcr.io/crunchtools` reference
+- Quay.io is the only registry
 
 ## Versioning
 - Semantic Versioning 2.0.0

.github/workflows/constitution.yml

@@ -18,4 +18,4 @@ permissions:
 jobs:
   constitution:
     name: Constitution
-    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.31.0
+    uses: crunchtools/constitution/.github/workflows/validate.yml@v1.39.4

.github/workflows/container.yml

@@ -0,0 +1,37 @@
+# Container release: build once per change, gate the digest, promote what was
+# tested (constitution III and Container Image VII). Quay.io only.
+#
+# ubi10-httpd-php-postgres is part of the ubi10 cascade: it cuts no release, so `cascade: true`
+# moves :latest with :main, and it is rebuilt when its parent dispatches
+# parent-image-updated.
+
+name: Container
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  repository_dispatch:
+    types: [parent-image-updated]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  container:
+    uses: crunchtools/constitution/.github/workflows/[email protected]
+    permissions:
+      contents: read
+      pull-requests: read
+    with:
+      image: quay.io/crunchtools/ubi10-httpd-php-postgres
+      rhsm: true
+      boot: systemd
+      contract-test: tests/gate.sh
+      cascade: true
+    secrets:
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+      RHSM_ACTIVATION_KEY: ${{ secrets.RHSM_ACTIVATION_KEY }}
+      RHSM_ORG_ID: ${{ secrets.RHSM_ORG_ID }}

.github/workflows/dependabot-automerge.yml

@@ -15,4 +15,4 @@ permissions:
 jobs:
   automerge:
     name: Dependabot
-    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.31.0
+    uses: crunchtools/constitution/.github/workflows/dependabot-automerge.yml@v1.39.4

.specify/memory/constitution.md

@@ -4,7 +4,7 @@
 > **Ratified:** 2026-03-10
 > **Amended:** 2026-10-02
 > **Status:** Active
-> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.31.0
+> **Inherits:** [crunchtools/constitution](https://github.com/crunchtools/constitution) v1.39.4
 > **Profile:** Container Image
 
 This file holds what is specific to ubi10-httpd-php-postgres. The fleet rules and the Container

tests/gate.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# The contract test for container-release.yml: boot $IMAGE (the gated digest)
+# under systemd and run the smoke tests inside it.
+set -euo pipefail
+: "${IMAGE:?IMAGE is the digest under test}"
+name="contract-$$"
+podman run -d --name "$name" --systemd=always "$IMAGE" >/dev/null
+trap 'podman rm -f "$name" >/dev/null' EXIT
+for _ in $(seq 1 60); do
+    state=$(podman exec "$name" systemctl is-system-running 2>/dev/null || true)
+    case "$state" in running|degraded) break ;; esac
+    sleep 1
+done
+podman cp tests/smoke-test.sh "$name:/tmp/smoke-test.sh"
+podman exec "$name" bash /tmp/smoke-test.sh