ci: workflow to publish node images to a public registry on a version tag (DISABLED)

git.vpn.cusano.net is now behind REQUIRE_SIGNIN_VIEW (INCIDENT-2026-09-06),
so a fresh Pi can no longer anonymously `docker pull` the node images or
fetch install.sh. Plan (owner, option 3): on a `v*` tag, build the three
node images (edge-node, icecast, op25-client, arm64) and push them to a
PUBLIC registry; source and the private Gitea registry stay walled.

This workflow is wired but INERT — the job is gated on
`vars.NODE_PUBLIC_PUBLISH == 'true'`, which is unset. It triggers on tags
and skips. Enabling is three repo variables + two secrets, documented in the
file header; no code change. Reuses the existing Gitea buildcache refs so
op25 doesn't recompile from scratch.

Not turning it on now — still building the core.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitea/workflows/publish-public.yml

@@ -0,0 +1,103 @@
+name: Publish public images
+
+# Push the three node images to a PUBLIC registry on a version tag, so a fresh
+# Pi can `docker pull` them without a Gitea login (git.vpn.cusano.net is now
+# behind REQUIRE_SIGNIN_VIEW — see INCIDENT-2026-09-06). Source + the private
+# registry stay walled; only the built node images go public.
+#
+# ── DISABLED ────────────────────────────────────────────────────────────────
+# The job is gated on `vars.NODE_PUBLIC_PUBLISH == 'true'`. Until that repo
+# variable is set the workflow triggers on tags but the job is skipped, so
+# this file is wired and inert. We're still building the core; flip it on when
+# self-serve node install is actually needed.
+#
+# To enable:
+#   1. Repo → Settings → Actions → Variables:
+#        NODE_PUBLIC_PUBLISH = true
+#        PUBLIC_REGISTRY     = ghcr.io            (or docker.io)
+#        PUBLIC_NAMESPACE    = <org-or-user>      (images land at <ns>/drb-<name>)
+#   2. Repo → Settings → Actions → Secrets:
+#        PUBLIC_REGISTRY_USER   = <push user>
+#        PUBLIC_REGISTRY_TOKEN  = <push token / PAT with write:packages>
+#   3. Re-push a tag (or run this workflow via workflow_dispatch).
+# ---------------------------------------------------------------------------
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: publish-public-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    # Inert until the repo variable is set. Do NOT convert this to `if: false`
+    # — the variable is the switch, no code change needed to go live.
+    if: ${{ vars.NODE_PUBLIC_PUBLISH == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: edge-node
+            context: ./drb-edge-node
+            file: ./drb-edge-node/Dockerfile
+            cache_name: edge-node
+          - name: icecast
+            context: ./icecast
+            file: ./icecast/Dockerfile
+            cache_name: icecast
+          - name: op25-client
+            context: ./op25-container
+            file: ./op25-container/Dockerfile
+            cache_name: op25-client
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # need tags for `git describe`
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."git.vpn.cusano.net"]
+              http = false
+              insecure = false
+
+      # Private Gitea registry — read only, to reuse the existing build cache
+      # (keeps the op25 image off a ~1h from-scratch compile).
+      - uses: docker/login-action@v3
+        with:
+          registry: git.vpn.cusano.net
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.BUILD_TOKEN }}
+
+      # Public registry — where the images are pushed.
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ vars.PUBLIC_REGISTRY }}
+          username: ${{ secrets.PUBLIC_REGISTRY_USER }}
+          password: ${{ secrets.PUBLIC_REGISTRY_TOKEN }}
+
+      - name: Version
+        id: meta
+        run: |
+          echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
+          echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.file }}
+          platforms: linux/arm64
+          push: true
+          tags: |
+            ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:${{ steps.meta.outputs.VERSION }}
+            ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:latest
+          cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ matrix.cache_name }}:buildcache