feat(gitops): add an Artifact Registry push target

[lucaghersi]

Goal

Let a service push to Google Artifact Registry instead of Harbor by changing two lines in its own workflow.

    with:
      artifact-registry: true
    secrets:
      gcp-service-account-key: ${{ secrets.GCP_ARTIFACT_PUBLISHER_KEY }}

The registry becomes europe-docker.pkg.dev and docker-image is prefixed with the publish repository, so sb-images/my-service is pushed as europe-docker.pkg.dev/staffbase-artifacts/images-publish/sb-images/my-service. docker-username / docker-password are ignored when it is set.

Default is false, so nothing changes for anyone until they opt in.

How to review

• The three call sites are identical; read one.
• The negated conditions are deliberate. inputs.artifact-registry && '' || secrets.docker-password would not blank the password: empty is falsy in a GitHub expression, so it falls through to the Harbor value. Hence !inputs.artifact-registry && secrets.docker-password || ''.
• docker-image is prefixed rather than replaced, so a service that overrides it keeps its own name.

Why a key and not Workload Identity Federation

WIF is set up and preferred, but a called workflow cannot raise the caller's permissions — adding permissions: id-token: write here would fail every caller that has not granted it. The key needs no permission, so a service migrates without touching its permissions block.

Services that grant id-token: write can pass the provider and account to gitops-github-action directly today; a workload-identity: true input here is the natural follow-up once some have.

Before merging

• Re-pin the action. All three jobs point at 2c7f44d08b1e3e03357a10cfd703bea1c55051c9, the head of feat(auth): support Workload Identity Federation for Artifact Registry gitops-github-action#163, marked UNRELEASED. That PR must merge and be tagged first.
• Staffbase/infrastructure#17348 must apply, so GCP_ARTIFACT_PUBLISHER_KEY is Terraform-managed. Note it is set to private visibility there — a public repository opting in would need that changed to all.

Rollback

Remove the two lines from the service. Pulls are unaffected in both directions, because the images repository serves Harbor as an upstream.

🤖 Generated with Claude Code

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[lucaghersi]

Superseded by #510, which adds a separate Artifact Registry template using Workload Identity Federation instead of a service account key.

Both approaches need a PR per consuming service, so the key bought nothing and would have had to be retired later. #510 creates no long-lived credential.