Summary

Adds an optional push of each service image to the shared GCP project, so the operator being developed in wanaware-operator has the images it needs to pull and run.

This is an alternative to #43. Same goal, but structured so it is strictly additive and cannot affect any existing deployment.

• New workflow .github/workflows/shared-registry-push.yaml — standalone reusable workflow. Authenticates to the shared project only, builds the image, pushes to the shared registry.
• deployment.yaml — one new job (push-to-shared-registry) that calls it, plus four new optional secret declarations. 48 insertions, 0 deletions — no existing line is changed or moved.

Isolation, concretely:

• Runs as its own job on its own runner, so its gcloud credentials and docker credential helper cannot leak into the deploy job.
• Only ever authenticates to the shared project — it never touches the WanAware registry, so it cannot disturb existing auth.
• continue-on-error at both step and job level, so a failure here can never turn a deploy run red.
• Skips cleanly when the shared secrets are absent, so repos that have not onboarded see no failed steps.

Callers need no changes. The shared push activates purely by setting the four GCP_*_SHARED secrets on a repo.

It rebuilds from source rather than retagging the deploy job's image, because that image is only loaded into the deploy runner's local docker daemon; pulling it instead would mean authenticating to the WanAware registry from this job, which is exactly the coupling this design avoids. The build uses the same context, Dockerfile and build-args, so the image matches what deployment.yaml ships.

Why

Required so the wanaware-operator has permission to pull and run the images. Supersedes #43, which reordered the existing auth steps — that made the build run before any GCP auth, which would break builds using a private base image from GAR.

QA Report

• No QA report required

CI/workflow-only change with no user-facing API surface.

Integration Tests

• No integration tests required

Added

Edited

Dependencies

Four new optional GitHub Actions secrets, per repo that should publish to the shared registry:

• GCP_SERVICE_ACCOUNT_SHARED
• GCP_WORKLOAD_IDENTITY_PROVIDER_SHARED
• GCP_PROJECT_SHARED
• GCP_REGISTRY_SHARED

All optional. Without them the shared push is skipped and behaviour is unchanged.

Notes for Reviewer

The new job pins the called workflow with @prod, matching the existing convention for WanAware/.github references. That means the shared push only becomes live once this is merged to prod.