S19: establish engineering repository

templates/common/.gitea/workflows/build.yaml

@@ -0,0 +1,46 @@
+name: Build, test and publish
+on:
+  push:
+    branches: ['**']
+
+jobs:
+  verify:
+    runs-on: @RUNNER@
+    env:
+      CI: 'true'
+      TARGET_PLATFORM: ${{ vars.TARGET_PLATFORM }}
+      GITEA_SERVER_URL: ${{ gitea.server_url }}
+      CI_REPOSITORY: ${{ gitea.repository }}
+      CI_COMMIT: ${{ gitea.sha }}
+      CI_REF: ${{ gitea.ref }}
+      CI_RUN_ID: ${{ gitea.run_id }}
+    steps:
+      - name: Check out pushed commit
+        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Verify pinned engineering resources
+        run: python3 scripts/engineering.py --check
+      - name: Identify workflow attempt
+        # Gitea 1.25 does not populate gitea.run_attempt. Use a unique value for
+        # container names and diagnostic artifacts, including reruns of one SHA.
+        run: java generated/ci/Ci.java attempt
+      - name: Build and test both images
+        run: java generated/ci/Ci.java verify
+      - name: Publish verified main images
+        if: success() && gitea.ref == 'refs/heads/main'
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: java generated/ci/Ci.java publish
+      - name: Collect diagnostics and clean up test containers
+        if: always()
+        run: java generated/ci/Ci.java cleanup
+      - name: Retain diagnostics for fourteen days
+        if: always()
+        uses: https://github.com/actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5
+        with:
+          name: diagnostics-${{ gitea.run_id }}-${{ env.CI_RUN_ATTEMPT }}
+          path: ci/artifacts/
+          if-no-files-found: error
+          retention-days: 14