[jwg054000]

Closes nothing yet — tracking is #3. Smallest useful Chromium-lane slice.

What this is

RustPipe-SC stays downstream of Cell Ranger / nf-core/scrnaseq. Not a Cell Ranger clone (no BCL→FASTQ, no barcode/UMI counting). Not prairie-rna-stream.

Changes

• Dockerfile — linux/amd64 multi-stage image with Debian HDF5 1.10 (--features hdf5) so Cell Ranger H5 / H5AD actually load. Runtime copies the stripped binary only. Base debian:bookworm-slim pinned by digest.
• GHCR workflow — ghcr.io/jwg054000/rustpipe-sc on push to main / tags / workflow_dispatch. Writes the digest to the job summary.
• PACKET.md — inputs (H5/H5AD/CSV), actual pipeline outputs, fail-closed table, digest-pin rule (pull published image; never rebuild in prairie-rna-stream).
• Fail-closed --input — reject STAR BAM / Cell Ranger BAM / rustqc featureCounts TSV / MTX. Cell Ranger BAM remains optional --qc-bam only.

Image status

ghcr.io/jwg054000/rustpipe-sc does not exist yet. Publish runs after merge (workflow is not on main until then).

Human clicks (Josh)

# 1. merge this PR, then publish
gh workflow run publish-ghcr.yml --repo jwg054000/RustPipe-SC

# 2. first GITHUB_TOKEN package is private — make it public
gh api --method POST -H "Accept: application/vnd.github+json" \
  /user/packages/container/rustpipe-sc/visibility \
  -f visibility=public

UI: https://github.com/users/jwg054000/packages/container/package/rustpipe-sc → Change visibility → Public.

If Actions is blocked: repo Settings → Actions → General → allow Actions. Workflow already sets permissions: packages: write (repo default token is read-only).

After publish, pin the summary digest:

ghcr.io/jwg054000/rustpipe-sc:0.3.0@sha256:<digest>

Do not add this image to prairie-rna-stream. Bulk RNA stays there.

Tests

cargo test — 115 passed (8 new fail-closed tests). No HDF5 fixtures in CI.