feat(gar): publish to Artifact Registry - #511

What

Everything needed to publish to Google Artifact Registry:

• actions/setup-artifact-registry — federates and configures Docker, npm and Maven in one step
• .github/workflows/template_gitops_gar.yml — the GitOps template, publishing through it

A service migrates by switching its uses: line and adding a permissions block. No registry credentials are passed.

    uses: Staffbase/gha-workflows/.github/workflows/template_gitops_gar.yml@v17
    permissions:
      contents: read
      deployments: write
      id-token: write

id-token: write has to be on the calling job — a called workflow cannot raise the caller's permissions.

Why it looks like this

A push is accepted only into images-publish, while deployments reference images, the virtual repository in front of it. That path is set in mops once, by hand, and Flux image automation rolls the tag from there.

So the template has no gitops-dev / gitops-stage / gitops-prod inputs: they make the action rewrite the whole image reference on every build, which pins the deployment to images-publish. Passing them fails with invalid input. A service using the file lists moves to image automation first.

With those gone, the released gitops-github-action@v8.2.1 is enough — no change and no release there.

docker-registry-api is passed explicitly: it is what the release retag talks to, and the action's default points at Harbor.

Before merging

• Re-pin the three setup-artifact-registry references to the release tag.
• Prove it on one service. The permissions semantics are from the documented rules, not an observed run.

actionlint clean. Requires the WIF pool from Staffbase/infrastructure#17340, applied. First consumer: Staffbase/satan#1169. Guide: Staffbase/infrastructure#17349.

🤖 Generated with Claude Code