feat(push): add public APNs gateway

.github/workflows/auto-tag-on-release-pr-merge.yml

@@ -1,12 +1,13 @@
 name: Auto-tag on Release PR Merge
 
-# Four release lanes share this one workflow. Three use an explicit branch
-# prefix; the chart lane also auto-detects a Chart.yaml version bump so a chart
-# feature PR can publish its own new version when merged:
+# Five release lanes share this one workflow. Four use an explicit branch
+# prefix; the main chart lane also auto-detects a Chart.yaml version bump so
+# a chart feature PR can publish its own new version when merged:
 #
 #   version-bump/<v>   → tag v<v>        → dispatch release.yml (desktop app)
 #   relay-release/<v>  → tag relay-v<v>  → dispatch docker.yml (relay image)
-#   chart-release/<v>  → tag chart-v<v>  → dispatch helm-chart.yml (helm chart)
+#   chart-release/<v>  → tag chart-v<v>  → dispatch helm-chart.yml (main helm chart)
+#   push-chart-release/<v> → tag push-chart-v<v> → dispatch push-gateway-helm-chart.yml
 #   any internal PR that bumps deploy/charts/buzz/Chart.yaml `version`
 #                       → tag chart-v<v>  → dispatch helm-chart.yml (helm chart)
 #   mobile-release/<v> → tag mobile-v<v> → (manual sprout_ref for buzz-releases build — see below)
@@ -68,6 +69,10 @@ jobs:
               VERSION="${BRANCH#chart-release/}"
               TAG_PREFIX="chart-v"
               DISPATCH="helm-chart" ;;
+            push-chart-release/*)
+              VERSION="${BRANCH#push-chart-release/}"
+              TAG_PREFIX="push-chart-v"
+              DISPATCH="push-gateway-helm-chart" ;;
             mobile-release/*)
               VERSION="${BRANCH#mobile-release/}"
               TAG_PREFIX="mobile-v"
@@ -134,6 +139,7 @@ jobs:
             release) WORKFLOW="release.yml" ;;
             docker)  WORKFLOW="docker.yml" ;;
             helm-chart) WORKFLOW="helm-chart.yml" ;;
+            push-gateway-helm-chart) WORKFLOW="push-gateway-helm-chart.yml" ;;
             *)
               echo "::error::Unhandled dispatch target: '$DISPATCH'"
               exit 1 ;;

.github/workflows/docker.yml

@@ -47,6 +47,7 @@ on:
   pull_request:
     paths:
       - "Dockerfile"
+      - "Dockerfile.push-gateway"
       - ".dockerignore"
       - ".github/workflows/docker.yml"
       - "Cargo.toml"
@@ -304,3 +305,150 @@ jobs:
             echo "gh attestation verify oci://${IMAGE_NAME}@${MERGED_DIGEST} --owner block"
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
+
+  push-gateway-build:
+    name: Build public push gateway (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-24.04
+            arch: amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            arch: arm64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+        with:
+          buildkitd-config-inline: |
+            [worker.oci]
+              max-parallelism = 2
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
+        with:
+          images: ghcr.io/block/buzz-push-gateway
+          labels: |
+            org.opencontainers.image.title=Buzz Push Gateway
+            org.opencontainers.image.description=Capability-gated APNs last hop for Buzz
+            org.opencontainers.image.licenses=Apache-2.0
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile.push-gateway
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+          cache-from: type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:${{ matrix.arch }}
+          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
+      - name: Export digest
+        if: github.event_name != 'pull_request'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: mkdir -p /tmp/gateway-digests && touch "/tmp/gateway-digests/${DIGEST#sha256:}"
+      - name: Upload digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: gateway-digests-${{ matrix.arch }}
+          path: /tmp/gateway-digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  push-gateway-merge:
+    name: Publish public push gateway image
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    needs: push-gateway-build
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Download per-arch digests
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          path: /tmp/gateway-digests
+          pattern: gateway-digests-*
+          merge-multiple: true
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+      - name: Log in to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
+        with:
+          images: ghcr.io/block/buzz-push-gateway
+          tags: |
+            type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
+      - name: Merge and publish manifest
+        id: manifest
+        working-directory: /tmp/gateway-digests
+        env:
+          META_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          set -euo pipefail
+          tags=(); while IFS= read -r tag; do [ -n "$tag" ] && tags+=("-t" "$tag"); done <<< "$META_TAGS"
+          digests=(); for digest in *; do digests+=("ghcr.io/block/buzz-push-gateway@sha256:${digest}"); done
+          docker buildx imagetools create "${tags[@]}" "${digests[@]}"
+          first_tag=$(echo "$META_TAGS" | head -n1)
+          digest=$(docker buildx imagetools inspect "$first_tag" --format '{{json .Manifest}}' | jq -r '.digest')
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
+      - name: Attest gateway image provenance
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-name: ghcr.io/block/buzz-push-gateway
+          subject-digest: ${{ steps.manifest.outputs.digest }}
+          push-to-registry: true
+      - name: Gateway publication summary
+        env:
+          GATEWAY_DIGEST: ${{ steps.manifest.outputs.digest }}
+          GATEWAY_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          set -euo pipefail
+          {
+            echo "### Published \`ghcr.io/block/buzz-push-gateway\`"
+            echo
+            printf "**Digest:** \`%s\`\n" "$GATEWAY_DIGEST"
+            echo
+            echo '**Tags:**'
+            echo "\`\`\`"
+            printf '%s\n' "$GATEWAY_TAGS"
+            echo "\`\`\`"
+            echo
+            echo 'Verify provenance before deployment:'
+            echo "\`\`\`"
+            printf 'gh attestation verify oci://ghcr.io/block/buzz-push-gateway@%s --owner block\n' "$GATEWAY_DIGEST"
+            echo "\`\`\`"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/helm-chart.yml

@@ -40,6 +40,7 @@ on:
   pull_request:
     paths:
       - "deploy/charts/buzz/**"
+      - "deploy/charts/buzz-push-gateway/**"
       - ".github/workflows/helm-chart.yml"
       - "ct.yaml"
 
@@ -88,6 +89,9 @@ jobs:
       - name: Build chart dependencies
         run: helm dependency build deploy/charts/buzz
 
+      - name: Push gateway chart lint + render guard
+        run: deploy/charts/buzz-push-gateway/tests/render.sh
+
       - name: ct lint
         run: ct lint --config ct.yaml --all
 

.github/workflows/push-gateway-helm-chart.yml

@@ -0,0 +1,68 @@
+name: push gateway helm chart
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Chart semver (without push-chart-v prefix)"
+        required: true
+      ref:
+        description: "Matching push-chart-v tag"
+        required: true
+  push:
+    tags: ["push-chart-v[0-9]*"]
+  pull_request:
+    paths:
+      - "deploy/charts/buzz-push-gateway/**"
+      - ".github/workflows/push-gateway-helm-chart.yml"
+permissions: {}
+env:
+  CHART_REPO: oci://ghcr.io/block/buzz/charts
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions: { contents: read }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          fetch-depth: 0
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        with: { version: v3.16.4 }
+      - run: deploy/charts/buzz-push-gateway/tests/render.sh
+      - run: deploy/charts/buzz-push-gateway/tests/release-contract.sh
+  publish:
+    if: github.event_name != 'pull_request'
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        with: { version: v3.16.4 }
+      - name: Verify release tag and chart version
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${INPUT_VERSION:-${REF_NAME#push-chart-v}}"
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
+          test "$(helm show chart deploy/charts/buzz-push-gateway | awk '/^version:/ {print $2}')" = "$version"
+          if [ -n "$INPUT_VERSION" ]; then
+            test "$(git rev-parse HEAD)" = "$(git rev-parse "refs/tags/push-chart-v${version}^{commit}")"
+          fi
+          echo "VERSION=$version" >> "$GITHUB_ENV"
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - run: helm package deploy/charts/buzz-push-gateway --destination dist
+      - run: helm push "dist/buzz-push-gateway-${VERSION}.tgz" "$CHART_REPO"