From 9bb5ae0e840bb3e1ed00cbb0f9fbc1a1df661db4 Mon Sep 17 00:00:00 2001
From: Evan Jarrett <evan@evanjarrett.com>
Date: Sat, 4 Apr 2026 13:43:30 -0500
Subject: [PATCH] split release workflows

---
 .tangled/workflows/release-appview.yml | 60 +++++++++++++++++++
 .tangled/workflows/release-hold.yml    | 60 +++++++++++++++++++
 .tangled/workflows/release-scanner.yml | 60 +++++++++++++++++++
 .tangled/workflows/release.yml         | 80 --------------------------
 4 files changed, 180 insertions(+), 80 deletions(-)
 create mode 100644 .tangled/workflows/release-appview.yml
 create mode 100644 .tangled/workflows/release-hold.yml
 create mode 100644 .tangled/workflows/release-scanner.yml
 delete mode 100644 .tangled/workflows/release.yml

diff --git a/.tangled/workflows/release-appview.yml b/.tangled/workflows/release-appview.yml
new file mode 100644
index 0000000..df1ee59
--- /dev/null
+++ b/.tangled/workflows/release-appview.yml
@@ -0,0 +1,60 @@
+# ATCR AppView Release
+# Builds multi-arch (amd64 + arm64) container image and publishes a manifest list.
+
+when:
+  - event: ["push"]
+    tag: ["v*"]
+
+engine: kubernetes
+image: quay.io/buildah/stable:latest
+architecture: [amd64, arm64]
+
+environment:
+  IMAGE_REGISTRY: atcr.io
+  IMAGE_USER: atcr.io
+  IMAGE_NAME: appview
+  DOCKERFILE: ./Dockerfile.appview
+
+steps:
+  - name: Build image archive
+    command: |
+      set -e
+      mkdir -p /artifacts
+      buildah bud \
+        --tag "${IMAGE_NAME}:${TANGLED_ARCHITECTURE}" \
+        --file "${DOCKERFILE}" \
+        .
+      buildah push \
+        "${IMAGE_NAME}:${TANGLED_ARCHITECTURE}" \
+        "oci-archive:/artifacts/${IMAGE_NAME}.tar"
+
+final:
+  architecture: amd64
+  image: quay.io/buildah/stable:latest
+  steps:
+    - name: Login to registry
+      command: |
+        echo "${APP_PASSWORD}" | buildah login \
+          -u "${IMAGE_USER}" \
+          --password-stdin \
+          "${IMAGE_REGISTRY}"
+
+    - name: Create and push multi-arch manifest
+      command: |
+        set -e
+        FULL="${IMAGE_REGISTRY}/${IMAGE_USER}/${IMAGE_NAME}"
+
+        buildah pull "oci-archive:/artifacts/amd64/${IMAGE_NAME}.tar"
+        buildah pull "oci-archive:/artifacts/arm64/${IMAGE_NAME}.tar"
+
+        buildah manifest create "${FULL}:${TANGLED_REF_NAME}"
+        buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "${IMAGE_NAME}:amd64"
+        buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "${IMAGE_NAME}:arm64"
+
+        buildah manifest push --all \
+          "${FULL}:${TANGLED_REF_NAME}" \
+          "docker://${FULL}:${TANGLED_REF_NAME}"
+
+        buildah manifest push --all \
+          "${FULL}:${TANGLED_REF_NAME}" \
+          "docker://${FULL}:latest"
diff --git a/.tangled/workflows/release-hold.yml b/.tangled/workflows/release-hold.yml
new file mode 100644
index 0000000..b771086
--- /dev/null
+++ b/.tangled/workflows/release-hold.yml
@@ -0,0 +1,60 @@
+# ATCR Hold Release
+# Builds multi-arch (amd64 + arm64) container image and publishes a manifest list.
+
+when:
+  - event: ["push"]
+    tag: ["v*"]
+
+engine: kubernetes
+image: quay.io/buildah/stable:latest
+architecture: [amd64, arm64]
+
+environment:
+  IMAGE_REGISTRY: atcr.io
+  IMAGE_USER: atcr.io
+  IMAGE_NAME: hold
+  DOCKERFILE: ./Dockerfile.hold
+
+steps:
+  - name: Build image archive
+    command: |
+      set -e
+      mkdir -p /artifacts
+      buildah bud \
+        --tag "${IMAGE_NAME}:${TANGLED_ARCHITECTURE}" \
+        --file "${DOCKERFILE}" \
+        .
+      buildah push \
+        "${IMAGE_NAME}:${TANGLED_ARCHITECTURE}" \
+        "oci-archive:/artifacts/${IMAGE_NAME}.tar"
+
+final:
+  architecture: amd64
+  image: quay.io/buildah/stable:latest
+  steps:
+    - name: Login to registry
+      command: |
+        echo "${APP_PASSWORD}" | buildah login \
+          -u "${IMAGE_USER}" \
+          --password-stdin \
+          "${IMAGE_REGISTRY}"
+
+    - name: Create and push multi-arch manifest
+      command: |
+        set -e
+        FULL="${IMAGE_REGISTRY}/${IMAGE_USER}/${IMAGE_NAME}"
+
+        buildah pull "oci-archive:/artifacts/amd64/${IMAGE_NAME}.tar"
+        buildah pull "oci-archive:/artifacts/arm64/${IMAGE_NAME}.tar"
+
+        buildah manifest create "${FULL}:${TANGLED_REF_NAME}"
+        buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "${IMAGE_NAME}:amd64"
+        buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "${IMAGE_NAME}:arm64"
+
+        buildah manifest push --all \
+          "${FULL}:${TANGLED_REF_NAME}" \
+          "docker://${FULL}:${TANGLED_REF_NAME}"
+
+        buildah manifest push --all \
+          "${FULL}:${TANGLED_REF_NAME}" \
+          "docker://${FULL}:latest"
diff --git a/.tangled/workflows/release-scanner.yml b/.tangled/workflows/release-scanner.yml
new file mode 100644
index 0000000..df2df8a
--- /dev/null
+++ b/.tangled/workflows/release-scanner.yml
@@ -0,0 +1,60 @@
+# ATCR Scanner Release
+# Builds multi-arch (amd64 + arm64) container image and publishes a manifest list.
+
+when:
+  - event: ["push"]
+    tag: ["v*"]
+
+engine: kubernetes
+image: quay.io/buildah/stable:latest
+architecture: [amd64, arm64]
+
+environment:
+  IMAGE_REGISTRY: atcr.io
+  IMAGE_USER: atcr.io
+  IMAGE_NAME: scanner
+  DOCKERFILE: ./Dockerfile.scanner
+
+steps:
+  - name: Build image archive
+    command: |
+      set -e
+      mkdir -p /artifacts
+      buildah bud \
+        --tag "${IMAGE_NAME}:${TANGLED_ARCHITECTURE}" \
+        --file "${DOCKERFILE}" \
+        .
+      buildah push \
+        "${IMAGE_NAME}:${TANGLED_ARCHITECTURE}" \
+        "oci-archive:/artifacts/${IMAGE_NAME}.tar"
+
+final:
+  architecture: amd64
+  image: quay.io/buildah/stable:latest
+  steps:
+    - name: Login to registry
+      command: |
+        echo "${APP_PASSWORD}" | buildah login \
+          -u "${IMAGE_USER}" \
+          --password-stdin \
+          "${IMAGE_REGISTRY}"
+
+    - name: Create and push multi-arch manifest
+      command: |
+        set -e
+        FULL="${IMAGE_REGISTRY}/${IMAGE_USER}/${IMAGE_NAME}"
+
+        buildah pull "oci-archive:/artifacts/amd64/${IMAGE_NAME}.tar"
+        buildah pull "oci-archive:/artifacts/arm64/${IMAGE_NAME}.tar"
+
+        buildah manifest create "${FULL}:${TANGLED_REF_NAME}"
+        buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "${IMAGE_NAME}:amd64"
+        buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "${IMAGE_NAME}:arm64"
+
+        buildah manifest push --all \
+          "${FULL}:${TANGLED_REF_NAME}" \
+          "docker://${FULL}:${TANGLED_REF_NAME}"
+
+        buildah manifest push --all \
+          "${FULL}:${TANGLED_REF_NAME}" \
+          "docker://${FULL}:latest"
diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
deleted file mode 100644
index 6e55264..0000000
--- a/.tangled/workflows/release.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-# ATCR Release Pipeline for Tangled.org
-# Builds multi-arch container images (amd64 + arm64) and creates manifest lists
-
-when:
-  - event: ["push"]
-    tag: ["v*"]
-
-engine: kubernetes
-image: quay.io/buildah/stable:latest
-architecture: [amd64, arm64]
-
-environment:
-  IMAGE_REGISTRY: atcr.io
-  IMAGE_USER: atcr.io
-
-steps:
-  - name: Login to registry
-    command: |
-      echo "${APP_PASSWORD}" | buildah login \
-        -u "${IMAGE_USER}" \
-        --password-stdin \
-        ${IMAGE_REGISTRY}
-
-  - name: Build and push AppView image
-    command: |
-      TAG="${IMAGE_REGISTRY}/${IMAGE_USER}/appview:${TANGLED_REF_NAME}-${TANGLED_ARCHITECTURE}"
-      buildah bud \
-        --tag "${TAG}" \
-        --file ./Dockerfile.appview \
-        .
-      buildah push "${TAG}"
-      mkdir -p /artifacts
-      echo "${TAG}" > /artifacts/appview.txt
-
-  - name: Build and push Hold image
-    command: |
-      TAG="${IMAGE_REGISTRY}/${IMAGE_USER}/hold:${TANGLED_REF_NAME}-${TANGLED_ARCHITECTURE}"
-      buildah bud \
-        --tag "${TAG}" \
-        --file ./Dockerfile.hold \
-        .
-      buildah push "${TAG}"
-      echo "${TAG}" > /artifacts/hold.txt
-
-  - name: Build and push Scanner image
-    command: |
-      TAG="${IMAGE_REGISTRY}/${IMAGE_USER}/scanner:${TANGLED_REF_NAME}-${TANGLED_ARCHITECTURE}"
-      buildah bud \
-        --tag "${TAG}" \
-        --file ./Dockerfile.scanner \
-        .
-      buildah push "${TAG}"
-      echo "${TAG}" > /artifacts/scanner.txt
-
-final:
-  architecture: amd64
-  image: quay.io/buildah/stable:latest
-  steps:
-    - name: Login to registry
-      command: |
-        echo "${APP_PASSWORD}" | buildah login \
-          -u "${IMAGE_USER}" \
-          --password-stdin \
-          ${IMAGE_REGISTRY}
-
-    - name: Create and push multi-arch manifests
-      command: |
-        for IMAGE in appview hold scanner; do
-          FULL="${IMAGE_REGISTRY}/${IMAGE_USER}/${IMAGE}"
-
-          AMD64_TAG=$(cat /artifacts/amd64/${IMAGE}.txt)
-          ARM64_TAG=$(cat /artifacts/arm64/${IMAGE}.txt)
-
-          buildah manifest create "${FULL}:${TANGLED_REF_NAME}"
-          buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "docker://${AMD64_TAG}"
-          buildah manifest add "${FULL}:${TANGLED_REF_NAME}" "docker://${ARM64_TAG}"
-          buildah manifest push --all "${FULL}:${TANGLED_REF_NAME}" "docker://${FULL}:${TANGLED_REF_NAME}"
-
-          buildah manifest push --all "${FULL}:${TANGLED_REF_NAME}" "docker://${FULL}:latest"
-        done