Build on the published Aurora image, and publish ours

Stage 0 now comes from quine-global-labs/aurora's workflow, at
forge.quinefoundation.com/quine-global-labs/aurora:stable, instead of
being rebuilt here from the submodule. The workflow logs in to the
registry, pulls it with the other bases, builds quine-linux on it, pushes
forge.quinefoundation.com/quine-global-labs/quine-linux (latest, date,
commit), then builds and uploads the ISO as before. On the generic
runner-x86-linux label.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/iso.yml

@@ -1,19 +1,22 @@
-name: Installer ISO
+name: Image and installer ISO
 
-# Builds the installer ISO (`task build-installer-iso`) and uploads it to
-# MinIO as <bucket>/installer/<commit>/install.iso and
+# Builds the quine-linux image on our Aurora build (published by
+# quine-global-labs/aurora's workflow to this forge's registry), pushes it to
+# forge.quinefoundation.com/quine-global-labs/quine-linux (`latest`,
+# `<date>`, the commit), then builds the installer ISO from it and uploads
+# that to MinIO as <bucket>/installer/<commit>/install.iso and
 # <bucket>/installer/latest/install.iso.
 #
-# Runs on a runner labelled `iso-builder`: bootc-image-builder needs an
-# x86_64 host with root podman (the job runs as root, or with sudo) and
-# ~30 GB of free disk. Stage 0 (the stage-0/ Aurora fork) also needs
-# buildah, cpp, skopeo and jq from the runner's distro; just, yq and cosign
-# are fetched below.
+# Runs on runner-x86-linux (host mode, root podman; petersweb-infra,
+# hosts/runner-x86-linux): bootc-image-builder needs an x86_64 host with
+# root podman and ~30 GB of free disk.
 #
-# Secret: MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's
-# just the MinIO user's name, `quine-linux`).
-# Variables (optional): MINIO_ENDPOINT (default https://s3.quineglobal.com),
-# MINIO_BUCKET (default quine-linux).
+# Secrets: REGISTRY_TOKEN (a Forgejo token with package write access),
+# MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's just the
+# MinIO user's name, `quine-linux`).
+# Variables (optional): REGISTRY_USER (the token's owner; default: the
+# actor), MINIO_ENDPOINT (default https://s3.quineglobal.com), MINIO_BUCKET
+# (default quine-linux).
 
 on:
   push:
@@ -25,17 +28,19 @@ concurrency:
   cancel-in-progress: true
 
 env:
+  REGISTRY: forge.quinefoundation.com
+  BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
+  IMAGE: forge.quinefoundation.com/quine-global-labs/quine-linux
   MINIO_ENDPOINT: ${{ vars.MINIO_ENDPOINT || 'https://s3.quineglobal.com' }}
   MINIO_BUCKET: ${{ vars.MINIO_BUCKET || 'quine-linux' }}
 
 jobs:
   iso:
-    runs-on: iso-builder
+    runs-on: runner-x86-linux
     timeout-minutes: 300
     steps:
+      # No submodules: stage 0 (Aurora) comes from the registry now.
       - uses: actions/checkout@v4
-        with:
-          submodules: true
 
       - name: Install task, mc, just, yq and cosign
         # Only what the runner doesn't already have: runner-x86-linux has
@@ -55,14 +60,20 @@ jobs:
           echo "$bin" >> "$GITHUB_PATH"
           for t in task just yq cosign mc; do printf '%s: ' "$t"; command -v "$t"; done
 
+      - name: Log in to the registry
+        env:
+          REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
       - name: Pull base images
         # Before the builds, with retries: quay.io's CDN cuts off multi-GB
         # layers now and then ("unexpected EOF"), and a pull inside
         # `buildah build` gives up after one reconnect. Already-pulled
-        # images cost only a manifest check. Stage 0's own bases (Aurora's
-        # image-versions.yml) aren't listed: Aurora pins them by digest.
+        # images cost only a manifest check.
         run: |
           for img in \
+            "$BASE_IMAGE" \
             quay.io/fedora/fedora-bootc:rawhide \
             registry.fedoraproject.org/fedora:rawhide \
             ghcr.io/osbuild/bootc-image-builder:latest; do
@@ -73,8 +84,18 @@ jobs:
             done
           done
 
+      - name: Build image
+        run: task build-image CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
+
+      - name: Push image
+        run: |
+          for t in latest "$(date -u +%Y%m%d)" "${GITHUB_SHA::12}"; do
+            podman tag localhost/quine-linux "$IMAGE:$t"
+            podman push --retry 5 "$IMAGE:$t"
+          done
+
       - name: Build installer ISO
-        run: task build-installer-iso CONTAINER_RUNTIME=podman
+        run: task build-installer-iso CONTAINER_RUNTIME=podman BASE_IMAGE="$BASE_IMAGE"
 
       - name: Upload to MinIO
         env:
@@ -93,6 +114,8 @@ jobs:
           mc cp "$iso" "${dest}/${GITHUB_SHA}/install.iso"
           mc cp "${dest}/${GITHUB_SHA}/install.iso" "${dest}/latest/install.iso"
 
-      - name: Clean up build output
+      - name: Clean up
         if: always()
-        run: rm -rf output
+        run: |
+          rm -rf output
+          podman logout "$REGISTRY" || true