From 52b08f08eac65a47d1009cbf38c2efec1ac1684b Mon Sep 17 00:00:00 2001
From: Pat Losoponkul <patextreme@hotmail.com>
Date: Tue, 28 Jul 2026 15:13:15 +0700
Subject: [PATCH] chore(ci): add republish-image workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a manual (workflow_dispatch) workflow to rebuild and re-push an
already-released Docker image to GHCR, without cutting a new release.

Motivation: `ghcr.io/hyperledger/identus-keycloak-plugins:0.2.0` became
unpullable — its tag index exists but every platform manifest it
references returns HTTP 404 (blobs garbage-collected on the orphaned
`ghcr.io/hyperledger/` namespace; the repo is `hyperledger-identus/
keycloak-plugins`). This is blocking the identus cloud-agent
integration tests, which pull that image.

The workflow checks out `v<version>`, rebuilds the plugin jar, and
pushes a clean multi-arch image with `--provenance=false` (no
attestation manifests). Triggering it for `0.2.0` restores the image.

Signed-off-by: Pat Losoponkul <patextreme@hotmail.com>
---
 .github/workflows/republish-image.yml | 66 +++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 .github/workflows/republish-image.yml

diff --git a/.github/workflows/republish-image.yml b/.github/workflows/republish-image.yml
new file mode 100644
index 0000000..d81acc8
--- /dev/null
+++ b/.github/workflows/republish-image.yml
@@ -0,0 +1,66 @@
+name: Republish Docker image
+
+# Manually rebuild and re-push an already-released image to GHCR.
+# Use case: the published multi-arch image became corrupt/unpullable
+# (e.g. platform manifests garbage-collected) and needs regenerating
+# without cutting a new release.
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Released version to rebuild & republish (e.g. 0.2.0). Must have a matching v<version> git tag."
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  republish:
+    name: Rebuild & republish ${{ inputs.version }}
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_ACTOR: hyperledger-bot
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Git checkout (release tag)
+        uses: actions/checkout@v4
+        with:
+          ref: v${{ inputs.version }}
+
+      - name: Setup Java and Scala
+        uses: olafurpg/setup-scala@v14
+        with:
+          java-version: openjdk@1.17
+
+      - name: Cache sbt
+        uses: coursier/cache-action@v6.4
+
+      - name: Build plugin jar
+        run: sbt "oid4vciPlugin / Compile / packageBin"
+
+      - name: Verify jar present for Dockerfile-ci
+        run: ls -la target/*.jar
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ env.GITHUB_ACTOR }}
+          password: ${{ env.GITHUB_TOKEN }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push multi-arch image
+        run: |
+          docker buildx build \
+            --platform=linux/arm64,linux/amd64 \
+            --provenance=false --sbom=false \
+            -f Dockerfile-ci \
+            --push \
+            -t ghcr.io/hyperledger/identus-keycloak-plugins:${{ inputs.version }} .