feat(ci): publish the Tracker's images to GHCR — GT-435

[beyondnetPeru]

Until today this repository shipped three Dockerfiles and zero image CD. No workflow built or pushed them, while the charts referenced:

chart	asked for
evolith-tracker-api	ghcr.io/…:0.0.1	nothing produced it
evolith-tracker-web	ghcr.io/…:0.0.1	nothing produced it
evolith-tracker-gateway	evolith-tracker-gateway:local	a tag no registry can ever serve

The deployment path was not untested — it was not wired. Every chart pointed at an image nothing produced, and no green CI could have shown it, because nothing had ever pulled them. Found while preflighting GT-435 from the Core repository, without a cluster.

What ships

images.yml builds and pushes all three to GHCR on every merge to main and develop — :latest plus :<sha> — authenticating with the built-in GITHUB_TOKEN, so it works from the first run with no new secret.

fail-fast: false on purpose: a partial publish is a deployment where some services are new and some are not, and that is worth seeing whole.

The workflow does not trust its own green tick. After pushing it runs docker buildx imagetools inspect on the sha tag. A push step exiting zero is not proof the image is pullable, and that gap between "the job was green" and "the artifact is there" is exactly what let three charts point at nothing.

Verified before wiring any of it

All three images were built locally from the documented src/ context, and all three succeed:

evolith-tracker-api:preflight        840MB
evolith-tracker-gateway:preflight    270MB
evolith-tracker-web:preflight         78MB

A CD that publishes a broken image is worse than none.

The guard found a defect in itself

check-deployable-images.mjs is ported from the Core and now runs in CI. Its negative test — not the happy path — caught it reading evolith-tracker-api:0.0.1 out of a comment in the new workflow: the comment that documents the broken reference. It was about to bless the very tag the comment exists to warn about.

Comments are now stripped before scanning, in both repositories.

Verified failing on all three defect classes here: a tag no workflow publishes, a :local tag, and a semver with no git tag behind it.

Charts

Now latest, with the reasoning in each values file — including why production must still override it with --set image.tag=<sha>: latest cannot be rolled back, and GT-448 requires a rollback that has actually been exercised.

🤖 Generated with Claude Code