[minor] Centralize Compose runtime tooling

.github/workflows/push.yml

@@ -214,7 +214,7 @@ jobs:
           sitectl_drupal_create_args="$(coordinated_template_args https://github.com/libops/drupal)"
           sitectl_isle_template_args="$(coordinated_template_args https://github.com/libops/isle)"
           if [ -z "${sitectl_isle_template_args}" ]; then
-            sitectl_isle_template_args="--template-repo https://github.com/libops/isle"
+            sitectl_isle_template_args="--template-repo https://github.com/libops/isle --template-branch main"
           fi
           sitectl_isle_create_args="${sitectl_isle_template_args} --fcrepo off --blazegraph off --isle-file-system-uri private --iiif triplet --iiif-topology disabled --bot-mitigation off"
           sitectl_repository=""
@@ -440,7 +440,7 @@ jobs:
       contents: read
       packages: read
 
-  test-level-4:
+  test-level-4-matrix:
     if: ${{ always() && needs.plan.outputs.test_level4 != '[]' && !cancelled() && !failure() }}
     needs: [plan, build-level-4]
     strategy:
@@ -458,6 +458,20 @@ jobs:
       contents: read
       packages: read
 
+  test-level-4:
+    if: ${{ always() }}
+    needs: [test-level-4-matrix]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Verify level-4 matrix
+        env:
+          RESULT: ${{ needs.test-level-4-matrix.result }}
+        run: |
+          if [[ "${RESULT}" != "success" && "${RESULT}" != "skipped" ]]; then
+            echo "Level-4 matrix result: ${RESULT}" >&2
+            exit 1
+          fi
+
   sitectl-create-smoke-test:
     if: ${{ always() && needs.plan.outputs.sitectl_create_smoke_matrix != '[]' && !cancelled() && !failure() }}
     needs: [plan, test-level-0, test-level-1, test-level-2, test-level-3, test-level-4]
@@ -470,7 +484,7 @@ jobs:
     with:
       plugin: ${{ matrix.plugin }}
       create-definition: default
-      create-args: ${{ matrix.create-args }}
+      create-args: --yolo ${{ matrix.create-args }}
       checkout-source: template
       project-path: generated-${{ matrix.plugin }}
       image-tags: ${{ matrix.image-tags }}

.github/workflows/template-contracts.yml

@@ -0,0 +1,54 @@
+name: Template contracts
+
+on:
+  workflow_dispatch:
+    inputs:
+      smoke:
+        description: Run each template's retained smoke test after contract checks
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  templates:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout buildkit
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          path: buildkit
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: buildkit/go.mod
+
+      - name: Checkout Compose templates
+        shell: bash
+        run: |
+          set -euo pipefail
+          for repository in archivesspace drupal isle ojs omeka-classic omeka-s wp; do
+            git clone --depth 1 "https://github.com/libops/${repository}.git" "templates/${repository}"
+          done
+
+      - name: Check contracts and image pins
+        working-directory: buildkit
+        run: >-
+          go run ./cmd/buildkit template-test --check-only
+          --root ../templates/archivesspace --root ../templates/drupal
+          --root ../templates/isle --root ../templates/ojs
+          --root ../templates/omeka-classic --root ../templates/omeka-s
+          --root ../templates/wp
+
+      - name: Run template smoke tests
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.smoke }}
+        working-directory: buildkit
+        run: >-
+          go run ./cmd/buildkit template-test --keep-going
+          --root ../templates/archivesspace --root ../templates/drupal
+          --root ../templates/isle --root ../templates/ojs
+          --root ../templates/omeka-classic --root ../templates/omeka-s
+          --root ../templates/wp

Makefile

@@ -74,14 +74,15 @@ TARGET_IMAGES = $(shell docker buildx bake --print $(TARGET) 2>/dev/null | jq -r
 TEST_IMAGE ?= $(if $(filter default,$(TARGET)),,$(TARGET))
 TEST_MODE ?= fallback
 TEST_ARGS ?=
+TEMPLATE_ROOTS ?=
 
 build:
 	mkdir -p build
 
-# This is a catch all target that is used to check for existance of an
-# executable when declared as a dependency.
-.PHONY: %
-%:
+# Executable prerequisites are explicit so a misspelled target retains Make's
+# useful "No rule to make target" error.
+.PHONY: docker jq login
+docker jq login:
 	$(call executable-exists,$@)
 
 # Prior to building, all folders which might be copied into Docker images must
@@ -96,8 +97,8 @@ folder-permissions:
 # have the executable bit set for all users. So that they can be executed by
 # the users we create like 'nginx'. We can not insure this via Git as it does
 # not track executable permissions for "groups" or "others".
-.PHONY: executable-permissons
-executable-permissons:
+.PHONY: executable-permissions
+executable-permissions:
 	find images -type f \
     \( \
       -name "*.sh" \
@@ -126,7 +127,7 @@ docker-buildx: | docker
 # Despite being a real target we make it PHONY so it is run everytime as $(TARGET) can change.
 .PHONY: build/bake.json
 .SILENT: build/bake.json
-build/bake.json: | docker-buildx jq build folder-permissions executable-permissons
+build/bake.json: | docker-buildx jq build folder-permissions executable-permissions
 	set -x; \
 		BRANCH="$(BRANCH)" \
 	CACHE_FROM_REPOSITORY=$(CACHE_FROM_REPOSITORY) \
@@ -181,6 +182,19 @@ list-tests:
 		$(if $(TEST_IMAGE),--image $(TEST_IMAGE),) \
 		$(if $(TEST),--test $(TEST),)
 
+.PHONY: template-test
+## Runs retained smoke tests from one or more Compose template checkouts.
+template-test:
+	@if [ -z "$(GO)" ]; then printf "Go is required to run template tests.\n"; exit 127; fi
+	@if [ -z "$(strip $(TEMPLATE_ROOTS))" ]; then printf "Set TEMPLATE_ROOTS to one or more template checkout paths.\n"; exit 2; fi
+	$(GO) run ./cmd/buildkit template-test $(foreach root,$(TEMPLATE_ROOTS),--root "$(root)") --keep-going
+
+.PHONY: template-check
+## Checks canonical template filenames and cross-template image digest parity.
+template-check:
+	@if [ -z "$(strip $(TEMPLATE_ROOTS))" ]; then printf "Set TEMPLATE_ROOTS to one or more template checkout paths.\n"; exit 2; fi
+	$(GO) run ./cmd/buildkit template-test $(foreach root,$(TEMPLATE_ROOTS),--root "$(root)") --check-only
+
 .PHONY: push
 ## Builds and pushes the target(s) into remote repository.
 push: build/bake.json login