images

Container image monorepo. Each subdirectory containing a Containerfile is built and published to ghcr.io/makeitworkcloud/<dir>:latest (and a SHA-tagged sibling).

Images

Directory	Base	Purpose
agent-pipe-uploader/	python:3.13-alpine	Internal MCP artifact-transfer service using caller-supplied signed URLs
gcloud-mcp/	pinned Node 22 slim + Google Cloud CLI	Keyless, allowlist-constrained Google Cloud CLI MCP server
tfroot-runner/	ghcr.io/actions/actions-runner:2.336.0 (Ubuntu)	gha-runner-scale-set runner with the OpenTofu IaC toolchain (kubectl, kustomize, sops, ansible, pre-commit, tflint, terraform-docs, infracost, checkov)
gh-cli/	alpine:3.24	Minimal gh image for automation Jobs

How It Works

push to main ─▶ detect changed images ─▶ pre-commit + hadolint ─▶ buildah build ─▶ push to GHCR ─▶ attest digest

workflow_dispatch accepts an optional image input to rebuild a single image; with no input it builds all images. Manual dispatch defaults to build & push; select build for a non-publishing validation run.

The detect step uses the Makefile (make changed-images / make list-images-json) to enumerate directories that contain a Containerfile.

Supply-chain attestations

After a publishing build, CI resolves the immutable digest behind the SHA tag, generates an SPDX JSON SBOM from that digest, and attaches both the SBOM and build provenance to the GHCR image. PR and non-publishing manual builds do not publish images or attestations.

Adding an Image

1. Create <name>/Containerfile
2. Open a PR — the build runs in PR mode (no push)
3. Merge to main — the image publishes to ghcr.io/makeitworkcloud/<name>:latest and :<sha>

Canonical Pre-commit Config

tfroot-runner/pre-commit-config.yaml is the canonical pre-commit configuration for every tfroot-* repository and terraform-libvirt-domain. It is:

1. Pre-cached into the runner image at build time so hooks don't re-fetch on every CI run
2. Fetched at CI time by the shared OpenTofu workflow in shared-workflows

To change these hooks, edit this file and merge it first. Downstream make test runs refresh the ignored generated configuration from this source.

License

GPLv3