ci: bootstrap PR-first runner image publishing

[infraclaw-dash]

Issue being fixed or feature implemented

Bootstrap PR-first runner images for #4702. A trusted pull_request_target publisher must already exist on the target branch before it can build an image for an unmerged requirements PR.

Companion implementation: dashpay/dash-selfhosted-image#1

What was done?

• Added only .github/workflows/runner-image-candidate.yml, pinned to reviewed immutable control revision baf8849b900555d66714e0e1fcffdff669b9e404 in the companion image repository.
• A PR edit to .github/runner-requirements.json is the automatic build flag. Build and publication use different disposable hosted VMs; the credentialed publisher never executes PR image or application code.
• After merge, the reusable workflow verifies the merged/current requirements and successful real Rust/Kotlin jobs on the exact candidate digest, then promotes that same digest. The default image channel advances only for Platform's actual default branch; development branches get their own channels.
• Candidate events supersede older builds for the same PR; promotions serialize per target branch.
• No controller installation, organization runner-group changes, production runner restart, application-code change or new broad fork allowance.

How Has This Been Tested?

• actionlint and git diff --check pass for this one-file caller.
• Companion implementation has 20 focused contract/lifecycle tests and CI for real image/compiler/confinement/KVM/emulator and cross-machine OCI transfer.
• End-to-end candidate application jobs are not yet proved: activation requires the dedicated GitHub App, candidate-only Platform runner group and reviewed host controller from the companion setup guide. Existing fork guards still apply.

Activation / ordering

1. Review and land the companion image implementation.
2. Land this trusted caller on v4.3-dev (and separately on any other branch intended to use it).
3. Configure the documented dedicated App/group/controller. The caller uses existing named DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets.
4. Use ci: remove host privilege requirements from persistent Linux runners #4702's manifest/routing to build and test its candidate before merging the consumer changes.

This bootstrap PR cannot activate itself from an unmerged head. It does not dispatch or publish images for unrelated PRs.

Breaking Changes

None to existing jobs; the caller only handles PRs changing the new requirements manifest. Promotion updates registry channels, not running containers.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests (companion implementation)
• I have made corresponding changes to the documentation if needed (companion activation guide)
• I have assigned this pull request to a milestone

PR Hygiene · 3fac2dd

• Bots — coderabbitai skipped after the window · thepastaclaw ✓
• Self-review — not asked of a bot author
• Within your 5 open PRs
• Build green
• Approvals
  • files with no dedicated owner (.github/workflows/runner-image-candidate.yml) — approved by shumkov

When every box is checked the PR Hygiene check passes and this can merge.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2bc8e1f4-5202-4dfd-9d9d-6eda150da05a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit 3fac2dd) · triage: low · Phase 2 only (queue backlog)

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

Verified the one-file change at head 3fac2dd: the caller pins an immutable reusable-workflow revision, explicitly passes two registry secrets, and separates candidate cancellation from branch-scoped promotion concurrency. The supplied Phase-2 reviews contain no findings, and source inspection identified no concrete in-scope defect; git diff --check passed. The companion workflow’s isolation and promotion checks were not independently verified from this local repository, actionlint was unavailable, and end-to-end activation remains unverified.

Review provenance

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

• Triage: low by gpt-6-astra (effort low) — The diff adds a small, contained CI caller with explicit event filters, concurrency rules, and an immutable reusable-workflow pin, delegating build and publication logic without changing any qualifying critical surface.
• Phase 1 reviewers: not run (skipped for throughput: 28 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort medium); agent phase2-reviewer, gpt-6-astra — architecture-layering (completed, effort medium); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort medium); agent phase2-reviewer

[ktechmidas]

/self-reviewed

[github-actions]

Bots are done — your move: post /self-reviewed.
Full checklist in the description.

[ktechmidas]

/self-reviewed

[github-actions]

Policy satisfied — this can merge.
Full checklist in the description.