ci: release, preview and cut-prerelease workflows

.github/workflows/cut-prerelease.yml

@@ -0,0 +1,13 @@
+# Cuts the next release candidate (vX.Y.Z-rcN) of the version the open release-please PR
+# proposes, as ccf-release-bot; release.yml then publishes :X.Y.Z-rcN. Run it by hand.
+name: cut-prerelease
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  cut:
+    uses: compliance-framework/workflows/.github/workflows/cut-prerelease.yml@899dbe5d7dac02de5fd60a92d764b189259e03dd # v1.5.0
+    permissions:
+      contents: read
+    secrets: inherit

.github/workflows/preview.yml

@@ -0,0 +1,28 @@
+# Publishes preview images of ghcr.io/compliance-framework/api: :main and :sha-<7> on pushes to
+# main, and :pr-<number> on PRs labelled `preview`. It never moves :latest (release.yml does).
+name: preview
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+
+concurrency:
+  # A merged PR's events carry the base branch as github.ref, so key PR runs by number.
+  group: preview-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  preview:
+    uses: compliance-framework/workflows/.github/workflows/preview.yml@899dbe5d7dac02de5fd60a92d764b189259e03dd # v1.5.0
+    with:
+      kind: image
+      on-main: true
+      images: '[{"name":"api","dockerfile":"Dockerfile","context":"."}]'
+    permissions:
+      contents: read
+      packages: write

.github/workflows/release.yml

@@ -0,0 +1,21 @@
+# Publishes ghcr.io/compliance-framework/api when a release is published: for vX.Y.Z the tags
+# X.Y.Z, X.Y, X and latest; for an rc (vX.Y.Z-rcN, from cut-prerelease) only X.Y.Z-rcN.
+# Built for linux/amd64 and linux/arm64 with the build arg VERSION=X.Y.Z[-rcN].
+name: release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    uses: compliance-framework/workflows/.github/workflows/release-go-image.yml@899dbe5d7dac02de5fd60a92d764b189259e03dd # v1.5.0
+    with:
+      images: '[{"name":"api","dockerfile":"Dockerfile","context":"."}]'
+    permissions:
+      contents: read
+      packages: write
+    secrets: inherit

AGENTS.md

@@ -19,8 +19,10 @@ Versions are coupled:
 - plugins pin the agent;
 - the UI depends on our JSON shapes.
 
-Releases are tags (`vX.Y.Z`, or `vX.Y.Z-rcN` for release candidates). CI publishes
-`ghcr.io/compliance-framework/api`; the publish workflow takes about 20 minutes. A
+Releases are tags (`vX.Y.Z`, or `vX.Y.Z-rcN` for release candidates), created by release-please
+when its release PR merges and by the `cut-prerelease` workflow for an rc; nobody pushes them by
+hand. Each published release runs `release.yml`, which publishes `ghcr.io/compliance-framework/api`;
+`preview.yml` publishes `:main`, `:sha-<7>` and, on PRs labelled `preview`, `:pr-<number>`. A
 mixed-version rollout must keep working: a new API must accept evidence from older agents.
 
 ## Commands

Dockerfile

@@ -32,6 +32,15 @@ RUN GOOS=linux go build -o /api
 
 FROM gcr.io/distroless/base-debian12 AS production
 
+# The release and preview workflows pass VERSION (X.Y.Z, X.Y.Z-rcN, main-<sha7> or
+# pr-<number>-<sha7>) and set the source and revision labels themselves.
+ARG VERSION=dev
+LABEL org.opencontainers.image.title="api" \
+	org.opencontainers.image.description="Service responsible for storing and retrieving OSCAL configuration" \
+	org.opencontainers.image.url="https://github.com/compliance-framework/api" \
+	org.opencontainers.image.licenses="AGPL-3.0" \
+	org.opencontainers.image.version="${VERSION}"
+
 COPY --from=builder /api /api
 # Open port 8080 to traffic
 EXPOSE 8080