feat(push): add public APNs gateway

.github/workflows/docker.yml

@@ -47,6 +47,7 @@
   pull_request:
     paths:
       - "Dockerfile"
+      - "Dockerfile.push-gateway"
       - ".dockerignore"
       - ".github/workflows/docker.yml"
       - "Cargo.toml"
@@ -304,3 +305,84 @@
             echo "gh attestation verify oci://${IMAGE_NAME}@${MERGED_DIGEST} --owner block"
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
+
+  push-gateway:
+    name: Build public push gateway image
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          persist-credentials: false
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3  # v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4.1.0
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
+        with:
+          images: ghcr.io/block/buzz-push-gateway
+          tags: |
+            type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
+            type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
+          labels: |
+            org.opencontainers.image.title=Buzz Push Gateway
+            org.opencontainers.image.description=Capability-gated APNs last hop for Buzz
+            org.opencontainers.image.licenses=Apache-2.0
+      - name: Build and publish gateway
+        id: build
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile.push-gateway
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=push-gateway
+          cache-to: type=gha,scope=push-gateway,mode=max
+      - name: Attest gateway image provenance
+        if: github.event_name != 'pull_request'
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-name: ghcr.io/block/buzz-push-gateway
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
+      - name: Gateway publication summary
+        if: github.event_name != 'pull_request'
+        env:
+          GATEWAY_DIGEST: ${{ steps.build.outputs.digest }}
+          GATEWAY_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          {
+            echo "### Published \`ghcr.io/block/buzz-push-gateway\`"
+            echo
+            echo "**Digest:** \`${GATEWAY_DIGEST}\`"
+            echo
+            echo '**Tags:**'
+            echo '```'
+            echo "${GATEWAY_TAGS}"
+            echo '```'
+            echo
+            echo 'Verify provenance before deployment:'
+            echo '```'
+            echo "gh attestation verify oci://ghcr.io/block/buzz-push-gateway@${GATEWAY_DIGEST} --owner block"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/helm-chart.yml

@@ -40,6 +40,7 @@ on:
   pull_request:
     paths:
       - "deploy/charts/buzz/**"
+      - "deploy/charts/buzz-push-gateway/**"
       - ".github/workflows/helm-chart.yml"
       - "ct.yaml"
 
@@ -88,6 +89,9 @@ jobs:
       - name: Build chart dependencies
         run: helm dependency build deploy/charts/buzz
 
+      - name: Push gateway chart lint + render guard
+        run: deploy/charts/buzz-push-gateway/tests/render.sh
+
       - name: ct lint
         run: ct lint --config ct.yaml --all
 

.github/workflows/push-gateway-helm-chart.yml

@@ -0,0 +1,67 @@
+name: push gateway helm chart
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Chart semver (without push-chart-v prefix)"
+        required: true
+      ref:
+        description: "Matching push-chart-v tag"
+        required: true
+  push:
+    tags: ["push-chart-v[0-9]*"]
+  pull_request:
+    paths:
+      - "deploy/charts/buzz-push-gateway/**"
+      - ".github/workflows/push-gateway-helm-chart.yml"
+permissions: {}
+env:
+  CHART_REPO: oci://ghcr.io/block/buzz/charts
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions: { contents: read }
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          fetch-depth: 0
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        with: { version: v3.16.4 }
+      - run: deploy/charts/buzz-push-gateway/tests/render.sh
+  publish:
+    if: github.event_name != 'pull_request'
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
+        with: { version: v3.16.4 }
+      - name: Verify release tag and chart version
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${INPUT_VERSION:-${REF_NAME#push-chart-v}}"
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
+          test "$(helm show chart deploy/charts/buzz-push-gateway | awk '/^version:/ {print $2}')" = "$version"
+          if [ -n "$INPUT_VERSION" ]; then
+            test "$(git rev-parse HEAD)" = "$(git rev-parse "refs/tags/push-chart-v${version}^{commit}")"
+          fi
+          echo "VERSION=$version" >> "$GITHUB_ENV"
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - run: helm package deploy/charts/buzz-push-gateway --destination dist
+      - run: helm push "dist/buzz-push-gateway-${VERSION}.tgz" "$CHART_REPO"