feat: add deploy automation reusables

.gitattributes

@@ -0,0 +1,6 @@
+* text=auto eol=lf
+
+*.sh text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.md text eol=lf

.github/CODEOWNERS

@@ -1,2 +1,2 @@
 # Default owner for everything in this repo.
-* @JorisJonkers-dev
+* @JorisJonkers

.github/workflows/add-to-project.yml

@@ -0,0 +1,61 @@
+name: 'Add to Project'
+
+'on':
+  'workflow_call':
+    'inputs':
+      'project-url':
+        'description': 'Organization Project URL.'
+        'required': false
+        'type': 'string'
+        'default': 'https://github.com/orgs/JorisJonkers-dev/projects/2'
+    'secrets':
+      'PROJECT_AUTOMATION_APP_ID':
+        'description': 'GitHub App id with organization Projects write permission.'
+        'required': false
+      'PROJECT_AUTOMATION_APP_PRIVATE_KEY':
+        'description': 'Private key for the organization Project automation App.'
+        'required': false
+      'PROJECT_AUTOMATION_TOKEN':
+        'description': 'Fallback token with organization Project write permission.'
+        'required': false
+
+'permissions':
+  'contents': 'read'
+
+'jobs':
+  'add-to-project':
+    'name': 'Add to Project'
+    'runs-on': 'ubuntu-latest'
+    'if': '${{ github.event.issue.node_id != '''' || github.event.pull_request.node_id != '''' }}'
+    'env':
+      'PROJECT_AUTOMATION_APP_ID': '${{ secrets.PROJECT_AUTOMATION_APP_ID }}'
+      'PROJECT_AUTOMATION_APP_PRIVATE_KEY': '${{ secrets.PROJECT_AUTOMATION_APP_PRIVATE_KEY }}'
+    'steps':
+      - 'name': 'Mint organization Project token'
+        'id': 'app-token'
+        'if': '${{ env.PROJECT_AUTOMATION_APP_ID != '''' && env.PROJECT_AUTOMATION_APP_PRIVATE_KEY != '''' }}'
+        'uses': 'actions/create-github-app-token@v3'
+        'with':
+          'app-id': '${{ env.PROJECT_AUTOMATION_APP_ID }}'
+          'private-key': '${{ env.PROJECT_AUTOMATION_APP_PRIVATE_KEY }}'
+          'owner': '${{ github.repository_owner }}'
+          'permission-organization-projects': 'write'
+          'permission-issues': 'read'
+          'permission-pull-requests': 'read'
+
+      - 'name': 'Validate Project token'
+        'env':
+          'PROJECT_TOKEN': '${{ steps.app-token.outputs.token || secrets.PROJECT_AUTOMATION_TOKEN }}'
+        'run': |
+          set -euo pipefail
+
+          if [ -z "$PROJECT_TOKEN" ]; then
+            echo '::error::Configure PROJECT_AUTOMATION_APP_ID and PROJECT_AUTOMATION_APP_PRIVATE_KEY, or PROJECT_AUTOMATION_TOKEN.'
+            exit 1
+          fi
+
+      - 'name': 'Add issue or pull request'
+        'uses': 'actions/add-to-project@v2.0.0'
+        'with':
+          'project-url': '${{ inputs.project-url }}'
+          'github-token': '${{ steps.app-token.outputs.token || secrets.PROJECT_AUTOMATION_TOKEN }}'

.github/workflows/container-publish.yml

@@ -47,7 +47,7 @@ jobs:
       - uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/deploy-bundle.yml

@@ -0,0 +1,121 @@
+name: 'Deploy Bundle'
+
+'on':
+  'workflow_call':
+    'inputs':
+      'deploy-dir':
+        'description': 'Path to the caller-owned deploy directory.'
+        'required': false
+        'type': 'string'
+        'default': 'deploy'
+      'images':
+        'description': 'Newline- or comma-separated image refs to include in the bundle manifest.'
+        'required': false
+        'type': 'string'
+        'default': ''
+      'package-version':
+        'description': 'Version range for @jorisjonkers-dev/deploy-config-schema.'
+        'required': false
+        'type': 'string'
+        'default': '^0.6.0'
+      'version':
+        'description': 'Bundle version. Defaults to the ref name or a sha-prefixed development version.'
+        'required': false
+        'type': 'string'
+        'default': ''
+      'bundle-name':
+        'description': 'Bundle package basename. Defaults to the repository name.'
+        'required': false
+        'type': 'string'
+        'default': ''
+      'publish':
+        'description': 'Publish the packed deploy bundle to GHCR.'
+        'required': false
+        'type': 'boolean'
+        'default': false
+    'secrets':
+      'packages-token':
+        'description': 'Token used for GitHub Packages reads and GHCR writes.'
+        'required': false
+    'outputs':
+      'bundle-ref':
+        'description': 'Published or publishable OCI bundle ref.'
+        'value': '${{ jobs.deploy-bundle.outputs.bundle-ref }}'
+      'bundle-path':
+        'description': 'Packed bundle tarball path.'
+        'value': '${{ jobs.deploy-bundle.outputs.bundle-path }}'
+
+'permissions':
+  'contents': 'read'
+  'packages': 'write'
+
+'jobs':
+  'deploy-bundle':
+    'name': 'Deploy Bundle'
+    'runs-on': 'ubuntu-latest'
+    'outputs':
+      'bundle-ref': '${{ steps.bundle-ref.outputs.bundle-ref }}'
+      'bundle-path': '${{ steps.bundle.outputs.bundle-path }}'
+    'steps':
+      - 'uses': 'actions/checkout@v7'
+
+      - 'uses': 'actions/checkout@v7'
+        'with':
+          'repository': 'JorisJonkers-dev/github-workflows'
+          'ref': '${{ github.job_workflow_sha }}'
+          'path': '.github-workflows'
+          'persist-credentials': false
+
+      - 'name': 'Pack deploy bundle'
+        'id': 'bundle'
+        'uses': './.github-workflows/actions/deploy-bundle'
+        'with':
+          'deploy-dir': '${{ inputs.deploy-dir }}'
+          'images': '${{ inputs.images }}'
+          'package-version': '${{ inputs.package-version }}'
+          'version': '${{ inputs.version }}'
+          'bundle-name': '${{ inputs.bundle-name }}'
+          'node-auth-token': '${{ secrets.packages-token || github.token }}'
+
+      - 'name': 'Resolve bundle ref'
+        'id': 'bundle-ref'
+        'env':
+          'BUNDLE_NAME': '${{ steps.bundle.outputs.bundle-name }}'
+          'BUNDLE_VERSION': '${{ steps.bundle.outputs.bundle-version }}'
+          'GITHUB_REPOSITORY_OWNER': '${{ github.repository_owner }}'
+        'run': |
+          set -euo pipefail
+
+          owner="$(printf '%s' "$GITHUB_REPOSITORY_OWNER" | tr '[:upper:]' '[:lower:]')"
+          name="$(printf '%s' "$BUNDLE_NAME" | tr '[:upper:]' '[:lower:]')"
+          printf 'bundle-ref=ghcr.io/%s/%s-deploy-bundle:%s\n' "$owner" "$name" "$BUNDLE_VERSION" >> "$GITHUB_OUTPUT"
+
+      - 'name': 'Upload deploy bundle artifact'
+        'uses': 'actions/upload-artifact@v5'
+        'with':
+          'name': 'deploy-bundle'
+          'path': '${{ steps.bundle.outputs.bundle-path }}'
+          'if-no-files-found': 'error'
+          'retention-days': 7
+
+      - 'uses': 'oras-project/setup-oras@v2'
+        'if': '${{ inputs.publish }}'
+
+      - 'name': 'Log in to GHCR'
+        'if': '${{ inputs.publish }}'
+        'env':
+          'GHCR_TOKEN': '${{ secrets.packages-token || github.token }}'
+        'run': |
+          set -euo pipefail
+
+          oras login ghcr.io --username "$GITHUB_ACTOR" --password-stdin <<< "$GHCR_TOKEN"
+
+      - 'name': 'Publish deploy bundle'
+        'if': '${{ inputs.publish }}'
+        'env':
+          'BUNDLE_PATH': '${{ steps.bundle.outputs.bundle-path }}'
+          'BUNDLE_REF': '${{ steps.bundle-ref.outputs.bundle-ref }}'
+        'run': |
+          set -euo pipefail
+
+          oras push "$BUNDLE_REF" "$BUNDLE_PATH:application/vnd.jorisjonkers.deployment.bundle.v1+tar"

.github/workflows/deploy-sources-render.yml

@@ -0,0 +1,104 @@
+name: 'Deploy Sources Render'
+
+'on':
+  'workflow_call':
+    'inputs':
+      'package-version':
+        'description': 'Version range for @jorisjonkers-dev/deploy-config-schema.'
+        'required': false
+        'type': 'string'
+        'default': '^0.6.0'
+      'environment':
+        'description': 'Deployment environment to compile.'
+        'required': false
+        'type': 'string'
+        'default': 'production'
+      'sources-path':
+        'description': 'Path to deployment-sources.yml.'
+        'required': false
+        'type': 'string'
+        'default': 'deployment-sources.yml'
+      'lock-path':
+        'description': 'Path to deployment.lock.yml.'
+        'required': false
+        'type': 'string'
+        'default': 'deployment.lock.yml'
+      'node-contract-path':
+        'description': 'Path to the locked node contract.'
+        'required': false
+        'type': 'string'
+        'default': 'inventory/node-contract.lock.yml'
+      'reachability-path':
+        'description': 'Path to reachability catalog.'
+        'required': false
+        'type': 'string'
+        'default': 'catalog/reachability.yml'
+      'output-path':
+        'description': 'Rendered Flux output directory.'
+        'required': false
+        'type': 'string'
+        'default': 'cluster/flux'
+      'update-lock':
+        'description': 'Run lock --update before compile.'
+        'required': false
+        'type': 'boolean'
+        'default': false
+      'check':
+        'description': 'Require compiled output and derived lock files to be committed.'
+        'required': false
+        'type': 'boolean'
+        'default': true
+      'cutover-parity':
+        'description': 'Run cutover parity against current-tree.'
+        'required': false
+        'type': 'boolean'
+        'default': false
+      'current-tree':
+        'description': 'Current live Flux tree used when cutover-parity is true.'
+        'required': false
+        'type': 'string'
+        'default': ''
+    'secrets':
+      'packages-token':
+        'description': 'Token used for GitHub Packages reads.'
+        'required': false
+    'outputs':
+      'image-tags':
+        'description': 'Image tags resolved from deployment.lock.yml.'
+        'value': '${{ jobs.deploy-sources-render.outputs.image-tags }}'
+
+'permissions':
+  'contents': 'read'
+
+'jobs':
+  'deploy-sources-render':
+    'name': 'Deploy Sources Render'
+    'runs-on': 'ubuntu-latest'
+    'outputs':
+      'image-tags': '${{ steps.render.outputs.image-tags }}'
+    'steps':
+      - 'uses': 'actions/checkout@v7'
+
+      - 'uses': 'actions/checkout@v7'
+        'with':
+          'repository': 'JorisJonkers-dev/github-workflows'
+          'ref': '${{ github.job_workflow_sha }}'
+          'path': '.github-workflows'
+          'persist-credentials': false
+
+      - 'name': 'Render deployment sources'
+        'id': 'render'
+        'uses': './.github-workflows/actions/deploy-sources-render'
+        'with':
+          'package-version': '${{ inputs.package-version }}'
+          'environment': '${{ inputs.environment }}'
+          'sources-path': '${{ inputs.sources-path }}'
+          'lock-path': '${{ inputs.lock-path }}'
+          'node-contract-path': '${{ inputs.node-contract-path }}'
+          'reachability-path': '${{ inputs.reachability-path }}'
+          'output-path': '${{ inputs.output-path }}'
+          'update-lock': '${{ inputs.update-lock }}'
+          'check': '${{ inputs.check }}'
+          'cutover-parity': '${{ inputs.cutover-parity }}'
+          'current-tree': '${{ inputs.current-tree }}'
+          'node-auth-token': '${{ secrets.packages-token || github.token }}'

.github/workflows/publish-api-clients.yml

@@ -76,7 +76,7 @@ jobs:
 
       # Install Node + configure the GitHub Packages registry only. Do NOT install here —
       # the typescript project is created by api-client-publish, which runs npm install itself.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: ${{ inputs.node-version }}
           registry-url: ${{ inputs.npm-registry-url }}