ci: single gate, merged image job, shared composite actions, docs workflow merge

.github/actions/setup-buildx/action.yml

@@ -0,0 +1,79 @@
+name: Set up Buildx
+description: >-
+  Logs in to Docker Hub with a short-lived OIDC token and sets up a Buildx
+  builder, Docker Build Cloud by default. Requires `id-token: write`.
+
+inputs:
+  connection-id:
+    description: Docker Hub OIDC connection id.
+    required: true
+  expected-sha:
+    description: Optional 40-character commit SHA the run must be on.
+    required: false
+    default: ''
+  driver:
+    description: Buildx driver; `cloud` or `docker-container`.
+    required: false
+    default: cloud
+  endpoint:
+    description: Build Cloud endpoint (cloud driver only).
+    required: false
+    default: docker/docker-agent
+  builder:
+    description: Create a builder. Set false for registry-only work such as imagetools.
+    required: false
+    default: 'true'
+
+outputs:
+  builder:
+    description: Builder name to pass to build-push-action (empty when builder is false).
+    value: ${{ steps.buildx.outputs.name }}
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        CONNECTION_ID: ${{ inputs.connection-id }}
+        EXPECTED_SHA: ${{ inputs.expected-sha }}
+      run: |
+        set -euo pipefail
+        if [[ -n "$EXPECTED_SHA" ]]; then
+          if [[ ! "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "expected-sha must be a lowercase 40-character SHA" >&2
+            exit 1
+          fi
+          if [[ "$EXPECTED_SHA" != "$GITHUB_SHA" ]]; then
+            echo "expected-sha does not match the workflow run commit $GITHUB_SHA" >&2
+            exit 1
+          fi
+        fi
+        if [[ -z "$CONNECTION_ID" ]]; then
+          echo "DOCKERHUB_OIDC_CONNECTION_ID must be configured" >&2
+          exit 1
+        fi
+        if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" || -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]]; then
+          echo "GitHub Actions OIDC is unavailable; the job needs id-token: write" >&2
+          exit 1
+        fi
+
+    - id: oidc
+      uses: docker/oidc-action@96ba694c64860c7209bcd1ede7d698c71564ef78 # v1.2.0
+      with:
+        connection-id: ${{ inputs.connection-id }}
+        expires-in: 3600
+
+    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      with:
+        username: docker
+        password: ${{ steps.oidc.outputs.token }}
+
+    - id: buildx
+      if: inputs.builder == 'true'
+      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+      with:
+        driver: ${{ inputs.driver }}
+        endpoint: ${{ inputs.driver == 'cloud' && inputs.endpoint || '' }}
+        version: ${{ inputs.driver == 'cloud' && 'lab:edge' || '' }}
+        # Downloading buildx takes seconds; caching it costs ~40 MB per branch.
+        cache-binary: false

.github/actions/setup-go/action.yml

@@ -0,0 +1,81 @@
+name: Set up Go
+description: >-
+  Installs Go and Task, then restores two caches: the module cache, shared by
+  every job and saved once per go.sum change, and the build cache, keyed per
+  job with the commit SHA as suffix so each job's compiled packages stay warm.
+  setup-go's built-in cache is keyed on go.sum alone, so a single snapshot is
+  shared by every job and never refreshed once saved. Caches are saved on main
+  only, when the job ends and only if `save` is true; everywhere else they are
+  restore-only so PR branches never fill the cache quota.
+
+inputs:
+  cache-name:
+    description: Build cache namespace; defaults to the job id.
+    required: false
+    default: ${{ github.job }}
+  save:
+    description: Save the build cache on main. Set false for jobs that share another job's namespace.
+    required: false
+    default: 'true'
+  task:
+    description: Install Task.
+    required: false
+    default: 'true'
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      with:
+        go-version-file: go.mod
+        cache: false
+
+    - if: inputs.task == 'true'
+      uses: go-task/setup-task@a00fbb05ce67b35648be3c78cbc9fd85354c757e # v2.2.0
+      with:
+        version: 3.53.1
+        # task_checksums.txt of the release above: task_linux_amd64.tar.gz / task_windows_amd64.zip.
+        checksum: ${{ runner.os == 'Windows' && '27c0cd248c12cba03d8958d954a3df981c900be885ec9ce5f6a3cdc4e9a19316' || 'a54a408f6861ff921f6e87774180db31bacd8c1e7c944ca696db9fea49a82fc7' }}
+
+    - id: paths
+      shell: bash
+      run: |
+        {
+          echo "mod=$(go env GOMODCACHE)"
+          echo "build=$(go env GOCACHE)"
+        } >> "$GITHUB_OUTPUT"
+
+    # Module cache: exact key per go.sum, so main saves it once per dependency
+    # change and every job on every ref restores the same entry.
+    - if: github.ref == 'refs/heads/main'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.paths.outputs.mod }}
+        key: gomod-${{ runner.os }}-${{ hashFiles('go.sum') }}
+        restore-keys: gomod-${{ runner.os }}-
+
+    - if: github.ref != 'refs/heads/main'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.paths.outputs.mod }}
+        key: gomod-${{ runner.os }}-${{ hashFiles('go.sum') }}
+        restore-keys: gomod-${{ runner.os }}-
+
+    # Build cache: per job, SHA suffix so main refreshes it on every push.
+    - if: github.ref == 'refs/heads/main' && inputs.save == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.paths.outputs.build }}
+        key: gobuild-${{ runner.os }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum') }}-${{ github.sha }}
+        restore-keys: |
+          gobuild-${{ runner.os }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum') }}-
+          gobuild-${{ runner.os }}-${{ inputs.cache-name }}-
+
+    - if: github.ref != 'refs/heads/main' || inputs.save != 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.paths.outputs.build }}
+        key: gobuild-${{ runner.os }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum') }}-${{ github.sha }}
+        restore-keys: |
+          gobuild-${{ runner.os }}-${{ inputs.cache-name }}-${{ hashFiles('go.sum') }}-
+          gobuild-${{ runner.os }}-${{ inputs.cache-name }}-

.github/actions/setup-hugo/action.yml

@@ -0,0 +1,22 @@
+name: Set up Hugo
+description: >-
+  Installs the Hugo release every docs workflow builds with, verifying it
+  against the release's published checksums. Kept in sync with the docker/docs
+  HUGO_VERSION pin so docs.docker.com and github.io render the same way.
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        HUGO_VERSION: 0.163.0
+        # hugo_<version>_checksums.txt entry for hugo_extended_<version>_linux-amd64.tar.gz.
+        HUGO_SHA256: 6291775b7d012f9b10fb377ba914e5b1589c0b0d2531b695fa9029be14750111
+      run: |
+        set -euo pipefail
+        archive="hugo_extended_${HUGO_VERSION}_linux-amd64.tar.gz"
+        curl -fsSLo "${RUNNER_TEMP}/${archive}" \
+          "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/${archive}"
+        echo "${HUGO_SHA256}  ${RUNNER_TEMP}/${archive}" | sha256sum -c -
+        sudo tar -xzf "${RUNNER_TEMP}/${archive}" -C /usr/local/bin hugo
+        hugo version

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+updates:
+  # Workflows and the composite actions under .github/actions. Pins are SHAs;
+  # Dependabot bumps the SHA and its version comment. A version outside the org
+  # allow list fails CI visibly. Go modules are deliberately not here: the
+  # bump-go-dependencies skill handles them.
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+      day: monday
+    # Let a release settle before adopting it.
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+