Vendor upstream images into the forge's mirror/ before pulling [skip ci]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/vendor-images.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Copies upstream images into this forge's registry, as
+# forge.quinefoundation.com/quine-global-labs/mirror/<registry>/<path>,
+# which runner-x86-linux's registries.conf tries before the upstream
+# registry (petersweb-infra, hosts/runner-x86-linux). So builds pull from
+# the forge, and still build from yesterday's copy when upstream is down.
+#
+# Usage: vendor-images.sh REF...   (registry-qualified, e.g.
+# quay.io/fedora/fedora-bootc:rawhide, or name:tag@sha256:...)
+#
+# Needs a `podman login` to the forge first. Best effort: an image that
+# can't be copied is a warning, not a failure; the build then gets the
+# mirror's last copy, or upstream's.
+set -uo pipefail
+
+mirror=${MIRROR:-forge.quinefoundation.com/quine-global-labs/mirror}
+# Read from upstream itself, not from the mirror registries.conf points at.
+export CONTAINERS_REGISTRIES_CONF=/dev/null
+
+for ref in "$@"; do
+  dest="docker://$mirror/${ref%@*}"
+  if [[ $ref == *@sha256:* ]]; then
+    # Pinned by digest: copy the whole index unchanged, so the digest the
+    # build asks for exists on the mirror.
+    opts=(--multi-arch all --preserve-digests)
+  else
+    opts=(--multi-arch system)
+  fi
+  echo "::group::$ref"
+  # Layers already on the mirror aren't downloaded again.
+  skopeo copy --retry-times 5 "${opts[@]}" "docker://$ref" "$dest" ||
+    echo "::warning::couldn't vendor $ref; builds get the mirror's last copy, or upstream's"
+  echo "::endgroup::"
+done

.forgejo/workflows/iso.yml

@@ -11,6 +11,10 @@ name: Image and installer ISO
 # hosts/runner-x86-linux): bootc-image-builder needs an x86_64 host with
 # root podman and ~30 GB of free disk.
 #
+# Upstream images (Fedora's, bootc-image-builder) are vendored into
+# forge.quinefoundation.com/quine-global-labs/mirror/ first, and pulled
+# from there (.forgejo/vendor-images.sh).
+#
 # Secrets: REGISTRY_TOKEN (a Forgejo token with package write access),
 # MINIO_SECRET_KEY. MINIO_ACCESS_KEY is a variable or a secret (it's just the
 # MinIO user's name, `quine-linux`).
@@ -70,11 +74,23 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
 
+      - name: Vendor upstream images
+        # Into the forge's mirror/ (.forgejo/vendor-images.sh), which the
+        # pulls below then read: the installer's two bases
+        # (installer/Containerfile) and bootc-image-builder (Taskfile.yml).
+        run: |
+          .forgejo/vendor-images.sh \
+            quay.io/fedora/fedora-bootc:rawhide \
+            registry.fedoraproject.org/fedora:rawhide \
+            ghcr.io/osbuild/bootc-image-builder:latest
+
       - name: Pull base images
         # Before the builds, with retries: quay.io's CDN cuts off multi-GB
         # layers now and then ("unexpected EOF"), and a pull inside
         # `buildah build` gives up after one reconnect. Already-pulled
-        # images cost only a manifest check.
+        # images cost only a manifest check. The upstream ones come from the
+        # forge's mirror/ when it has them (runner-x86-linux's
+        # registries.conf).
         run: |
           for img in \
             "$BASE_IMAGE" \