Build the production image from source (#1539, #1538) #1577

Summary

Build the production image from source (#1539, #1538): its entrypoint starts the production server with STOPSIGNAL SIGTERM; no publishing or attestation.

Part of #1558, server-side identity on every adapter. Plan ID A6, planned in wave 5 (MVP: Fastly and Axum); priority P1, size S. Design: spec; order and dependencies: plan.

Requirements

AX-5 Production image

An image built from source runs the production server.

Current state

What the code does today, from the design's survey at the revisions it names:

• AX-5: Separate the source-built native image #1539 builds the production image; Publish release binaries and the Axum image to GitHub Packages #1543 publishes the dev-server image (STOPSIGNAL SIGINT).

Acceptance criteria

• AX-5: Its entrypoint starts the production server with STOPSIGNAL SIGTERM. Publishing and attesting the image are outside this design (DEC-19)

Dependencies

Blocked by:

• Serve Axum in production mode from main #1573 Serve Axum in production mode from main (new in this plan)

Blocks:

• Axum reference infrastructure #1578 Axum reference infrastructure (new in this plan)

Related pull requests

• Separate the source-built native image #1539 Separate the source-built native image: carries part of this work.

  Fixes the plan asks of Separate the source-built native image #1539

  When this unit is ported to main: fix the failing Axum test. All units: replace TS_* names (AX-2).

• Separate the native AWS runtime wrapper #1538 Separate the native AWS runtime wrapper: carries part of this work.

  Fixes the plan asks of Separate the native AWS runtime wrapper #1538

  When this unit is ported to main: All units: replace TS_* names (AX-2).