ci(console): build per-PR canary console image (JITSU-159)

[absorbb]

Part of JITSU-159 — the build half of per-PR canary console deployments. Companion infra PR: jitsucom/jitsu-cloud-infra#73.

What

Adds .github/workflows/build-console-canary.yml. When a PR is labeled canary:console, it builds the console image from the PR head and pushes jitsucom/console:canary-<short_sha>. The ArgoCD ApplicationSet in jitsu-cloud-infra (k8s/canary-console) then deploys it at pr<N>.use.jitsu.com in read-only mode.

Key decisions

• pull_request, NOT pull_request_target — this is the trust boundary. GitHub withholds DOCKERHUB_* secrets from fork-triggered pull_request runs, so a fork PR cannot build/push a canary image even if labeled. Combined with the maintainer-only label, canary code is always maintainer-opted-in code from a same-repo branch.
• Tag = first 7 chars of the PR head SHA (${HEAD_SHA:0:7}), which is exactly ArgoCD's head_short_sha_7 and matches this repo's --short=7 convention. The ApplicationSet references canary-{{.head_short_sha_7}}; the two must stay in lockstep or canaries ImagePullBackOff. Deliberately not git rev-parse --short (which can grow past 7 on ambiguity).
• Single console target, linux/arm64 — canaries inherit the prod console's nodeSelector: {purpose: sync} + arm64 toleration, so they schedule on the arm64 sync pool. (Comment flags adding amd64 if that placement changes.)
• Mirrors the existing services.yaml publish patterns: docker/login-action@v4 (DOCKERHUB_USERNAME/TOKEN), buildx cloud driver (endpoint: jitsucom/newjitsu), docker buildx build --target console -f all.Dockerfile . with the JITSU_BUILD_* args.
• permissions: contents: read; per-PR concurrency with cancel-in-progress.

Notes

• Old canary-<sha> tags accumulate in Docker Hub across pushes (not garbage-collected here) — acceptable; can add cleanup later.
• Requires the canary:console label to exist in the repo and the DNS/token/controller prerequisites tracked in the infra PR before canaries are live end-to-end.

🤖 Generated with Claude Code

[jitsu-code-review]

Reviewed the new canary build workflow in \ across trigger conditions, trust boundary assumptions, secret usage, tagging contract, and build/push behavior.\n\nI did not find actionable bugs, security issues, or correctness regressions in this changeset.

[jitsu-code-review]

Reviewed the new canary build workflow in .github/workflows/build-console-canary.yml across trigger conditions, trust boundary assumptions, secret usage, tagging contract, and build/push behavior.

I did not find actionable bugs, security issues, or correctness regressions in this changeset.