ci: publish destination container image

.github/workflows/container.yml

@@ -0,0 +1,64 @@
+name: Container publication
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: indexarr-rs-container-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: [self-hosted, node-b, linux, x64, publish, docker]
+    env:
+      IMAGE: ghcr.io/thedancingdeveloper-org/indexarr-rs
+    steps:
+      - uses: actions/checkout@v7
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Define immutable destination tag
+        id: tags
+        shell: bash
+        run: |
+          if [[ "$GITHUB_REF_TYPE" == tag ]]; then
+            case "$GITHUB_REF_NAME" in v[0-9]*) ;; *) exit 1 ;; esac
+            printf 'tags=%s\n' "$IMAGE:$GITHUB_REF_NAME,$IMAGE:latest,$IMAGE:sha-$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+          else
+            test "$GITHUB_REF_NAME" = main
+            printf 'tags=%s\n' "$IMAGE:dev,$IMAGE:sha-$GITHUB_SHA" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Build and publish destination image once
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: Dockerfile
+          platforms: ${{ github.ref_type == 'tag' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
+          push: true
+          provenance: false
+          tags: ${{ steps.tags.outputs.tags }}
+          cache-from: ''
+          cache-to: ''
+          secrets: |
+            git_auth_token=${{ secrets.FORGEJO_CARGO_TOKEN }}
+      - name: Verify anonymous destination manifest
+        shell: bash
+        run: |
+          if [[ "$GITHUB_REF_TYPE" == tag ]]; then tag="$GITHUB_REF_NAME"; else tag=dev; fi
+          token=$(curl -fsS 'https://ghcr.io/token?service=ghcr.io&scope=repository:thedancingdeveloper-org/indexarr-rs:pull' | jq -r .token)
+          test -n "$token"
+          curl -fsS -H "Authorization: Bearer $token" \
+            -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
+            "https://ghcr.io/v2/thedancingdeveloper-org/indexarr-rs/manifests/$tag" > manifest.json
+          jq -e '.schemaVersion == 2' manifest.json >/dev/null