From f87d87bae004589d3d770a7773ba2e9d891d9405 Mon Sep 17 00:00:00 2001
From: "chase (AI)" <chase+robot@blockstream.com>
Date: Fri, 30 Oct 2026 12:05:03 +0100
Subject: [PATCH] Publish releases through the shared ci-components workflow

Replace the GitLab CI publishing scripts with a GitHub Actions caller of
Blockstream/ci-components publish.yml: native amd64 and arm64 builds,
immutable version tags, keyless cosign signature. The destination and
identity come from repository secrets and environments.
---
 .github/workflows/publish-mirror.yml | 67 ++++++++++++++++++++++++++++
 README.md                            |  9 ++++
 2 files changed, 76 insertions(+)
 create mode 100644 .github/workflows/publish-mirror.yml

diff --git a/.github/workflows/publish-mirror.yml b/.github/workflows/publish-mirror.yml
new file mode 100644
index 00000000..7d6d8024
--- /dev/null
+++ b/.github/workflows/publish-mirror.yml
@@ -0,0 +1,67 @@
+# Additional registry destinations are configured through repository secrets and environments.
+name: Publish image mirror
+
+on:
+  push:
+    branches: [master]
+    tags:
+      - 'esplora_v*'
+
+permissions: {}
+
+concurrency:
+  group: publish-mirror-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  metadata:
+    name: Resolve image tag
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.meta.outputs.tag }}
+    steps:
+      - name: Validate ref and resolve tag
+        id: meta
+        shell: bash
+        env:
+          REF_TYPE: ${{ github.ref_type }}
+          REF_NAME: ${{ github.ref_name }}
+          COMMIT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          [[ "$COMMIT_SHA" =~ ^[0-9a-f]{40}$ ]] || exit 1
+          if [[ "$REF_TYPE" == branch && "$REF_NAME" == master ]]; then
+            tag="${COMMIT_SHA:0:12}"
+          elif [[ "$REF_TYPE" == tag && "$REF_NAME" =~ ^esplora_v[A-Za-z0-9_.-]+$ ]]; then
+            tag="$REF_NAME"
+          else
+            echo 'Unsupported publishing ref' >&2
+            exit 1
+          fi
+          [[ "$tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]] || exit 1
+          printf 'tag=%s\n' "$tag" >> "$GITHUB_OUTPUT"
+
+  publish:
+    needs: metadata
+    permissions:
+      contents: read
+      id-token: write
+    uses: Blockstream/ci-components/.github/workflows/publish.yml@v1
+    with:
+      environment: production
+      context: .
+      dockerfile: contrib/Dockerfile
+      build-args: |
+        FOOT_HTML=<!-- ${{ github.sha }} -->
+      platforms: |
+        linux/amd64
+        linux/arm64
+      tags: |
+        ${{ needs.metadata.outputs.tag }}
+    secrets:
+      workload-identity-provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+      service-account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+      image: ${{ secrets.GAR_IMAGE }}
diff --git a/README.md b/README.md
index c980c56b..18ad49cd 100644
--- a/README.md
+++ b/README.md
@@ -209,6 +209,15 @@ docker build -t esplora -f contrib/Dockerfile .
 
 Alternatively, you may use the pre-built [`blockstream/esplora` image](https://hub.docker.com/r/blockstream/esplora) from Docker Hub. The `latest` tag tracks the `master` branch; release tags (e.g. `esplora_v2.10`) are also published as versioned image tags (e.g. `blockstream/esplora:v2.10`) that can be pinned for reproducible deployments.
 
+The GitHub Actions workflow `.github/workflows/publish-mirror.yml` publishes signed
+images for `linux/amd64` and `linux/arm64` to an additional registry using the shared
+`Blockstream/ci-components` publish workflow. Pushes to `master` use the first 12
+characters of the commit SHA as the image tag; `esplora_v*` releases retain the full
+release tag. These image tags are immutable. Configure repository secrets
+`GCP_WORKLOAD_IDENTITY_PROVIDER`, `GCP_SERVICE_ACCOUNT`, and `GAR_IMAGE` (the image
+path without a tag), and the `production` and `production-build` environments.
+Deployment policies are configured in repository environment settings.
+
 ## How to run the explorer for Bitcoin mainnet
 
 ```bash