ci: request a dev deploy after publishing

.github/workflows/publish-ghcr.yml

@@ -24,6 +24,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      pull-requests: read
     strategy:
       matrix:
         include:
@@ -58,6 +59,7 @@ jobs:
             type=sha,suffix=${{ matrix.suffix }}
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -69,6 +71,52 @@ jobs:
           cache-from: type=gha,scope=${{ matrix.target }}
           cache-to: type=gha,scope=${{ matrix.target }},mode=max
 
+      # The dev stage of Forge Central pins the prod-target image, so only that
+      # matrix leg asks for a deploy.
+      - name: Resolve the source pull request
+        if: matrix.target == 'prod'
+        id: source
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          pr_url=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/pulls" \
+            --jq 'map(select(.merged_at != null)) | .[0].html_url // ""')
+          echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"
+
+      - name: Mint fil-forge-bot token
+        if: matrix.target == 'prod'
+        id: bot
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.FORGE_BOT_APP_ID }}
+          private-key: ${{ secrets.FORGE_BOT_PRIVATE_KEY }}
+          owner: fil-forge
+          repositories: infra-central
+
+      - name: Request a digest bump in the Forge Central "dev" environment
+        if: matrix.target == 'prod'
+        env:
+          GH_TOKEN: ${{ steps.bot.outputs.token }}
+          DIGEST: ${{ steps.build.outputs.digest }}
+          PR_URL: ${{ steps.source.outputs.pr_url }}
+        run: |
+          set -euo pipefail
+          [[ "$DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]] \
+            || { echo "::error::unexpected digest: '$DIGEST'"; exit 1; }
+          jq -n \
+            --arg service swarf \
+            --arg digest "$DIGEST" \
+            --arg source_repo "$GITHUB_REPOSITORY" \
+            --arg commit "$GITHUB_SHA" \
+            --arg pr_url "$PR_URL" \
+            --arg run_url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            '{event_type: "bump-deployed-image",
+              client_payload: {service: $service, digest: $digest,
+                               source_repo: $source_repo, commit: $commit,
+                               pr_url: $pr_url, run_url: $run_url}}' \
+            | gh api --method POST repos/fil-forge/infra-central/dispatches --input -
+
   # Build check for PRs (no push) - single platform for speed
   build-check:
     name: Build Check (${{ matrix.target }})

README.md

@@ -144,3 +144,30 @@ must be the issuer of the revoked delegation or appear as an issuer in the
 witness path provided with `WithWitnessPath`. `Get` returns a full
 `store.RevocationRecord`; `Stream` returns compact `api.FirehoseRevocation`
 values.
+
+## Container images
+
+A push to `main` publishes to GHCR from the `Container` workflow. The `prod`
+target becomes `ghcr.io/fil-forge/swarf:main`, a stripped binary on a slim
+Debian base. The `dev` target becomes `ghcr.io/fil-forge/swarf:main-dev` and
+adds delve plus a handful of debugging tools. Both cover `linux/amd64` and
+`linux/arm64`, and both also carry a `sha-<short-sha>` tag, the dev image with a
+`-dev` suffix.
+
+## Deploying to dev
+
+The same run asks [infra-central][] to deploy the prod image. It dispatches a
+`bump-deployed-image` event carrying the manifest digest it just pushed, and
+infra-central's [Bump deployed image][receiver] workflow opens a pull request
+pinning that digest in `terraform/envs/dev/apps/terraform.tfvars`, with
+auto-merge enabled. infra-central's [Check and deploy][deploy] workflow runs
+`tofu apply` on `dev/apps` on every push to its `main`, so merging that pull
+request is what deploys.
+
+The dispatch runs as the `fil-forge-bot` GitHub App and needs the
+`FORGE_BOT_APP_ID` variable and the `FORGE_BOT_PRIVATE_KEY` secret. Prod pins
+are promoted by hand.
+
+[infra-central]: https://github.com/fil-forge/infra-central
+[receiver]: https://github.com/fil-forge/infra-central/blob/main/.github/workflows/bump-deployed-image.yml
+[deploy]: https://github.com/fil-forge/infra-central/blob/main/.github/workflows/check-and-deploy.yml