GitHub Actions + GHCR

Goal

GitHub Actions and GHCR can provide source/build/release automation for tenant applications.

A workflow can:

1. check out source;
2. run tests;
3. build the container image;
4. push an immutable image to GHCR;
5. resolve the immutable SHA256 digest;
6. record the source/release identity;
7. invoke an authorized GWEB deployment or artifact-ingestion path appropriate to the tenant;
8. wait for and inspect the verified deployment result.

GHCR is not the same as GWEB runtime pull access

An immutable GHCR reference identifies a release artifact:

ghcr.io/<owner>/<repository>@sha256:<digest>

That does not automatically mean the GWEB K3s runtime can pull an arbitrary private GHCR image directly.

For the standard interactive local developer workflow, build locally and use:

gwebc --profile <profile> \
  deploy push <application> \
  --environment dev \
  --local-image <application>:dev \
  --replicas <replicas> \
  --port <container-port>

GWEB then imports the image into its managed internal registry and deploys the resulting immutable internal reference.

For automated CI/CD, use only the GWEB-approved integration for that repository/tenant. Do not assume that deploy apply --image ghcr.io/... is valid unless the GWEB runtime has explicitly been configured to pull that registry reference.

CI authorization

Repository, branch/ref, application, environment, image prefix, OIDC audience, immutable-digest requirements, and artifact-ingestion policy may be enforced by GWEB.

The tenant workflow should not require possession of a GWEB privileged control token, Kubernetes credentials, or cluster-node SSH access.