Add cache push/pull

.github/workflows/ci.yml

@@ -8,6 +8,12 @@ env:
 
 jobs:
   build:
+    permissions:
+      contents: read
+      # Required by the cache-registry end-to-end test, which pushes
+      # test cache images to ghcr.io/${{ github.repository }}/pg-ephemeral-cache-test
+      # using GITHUB_TOKEN.
+      packages: write
     strategy:
       matrix:
         os:
@@ -88,6 +94,18 @@ jobs:
     - name: Run doctests
       run: cargo --verbose test --doc --all-features --release
 
+    # End-to-end cache registry round-trip test. Pushes and pulls against
+    # ghcr.io using GITHUB_TOKEN. Gated to a single linux-musl matrix
+    # entry: the test is a registry integration check, not a platform
+    # compat check, so running it on every matrix target would be waste.
+    - name: Log in to ghcr.io for cache-registry test
+      if: ${{ matrix.os.cargo_build_target == 'x86_64-unknown-linux-musl' }}
+      run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+    - name: Run cache-registry end-to-end test
+      if: ${{ matrix.os.cargo_build_target == 'x86_64-unknown-linux-musl' }}
+      run: target/${{ matrix.os.cargo_build_target }}/release/manager pg-ephemeral github-actions cache-registry test
+
     - name: Set up Ruby 3.4 for macOS gem build
       if: ${{ endsWith(matrix.os.cargo_build_target, '-darwin') }}
       uses: ruby/setup-ruby@4c56a21280b36d862b5fc31348f463d60bdc55d5 # v1.301.0

manager/Cargo.toml

@@ -30,6 +30,7 @@ similar = "3"
 stratosphere-core.workspace = true
 syn.workspace = true
 tar = "0.4"
+thiserror.workspace = true
 toml.workspace = true
 toml_edit.workspace = true
 url.workspace = true

manager/src/pg_ephemeral.rs

@@ -1,3 +1,4 @@
+pub(crate) mod github_actions;
 pub(crate) mod npm;
 pub(crate) mod ruby;
 
@@ -13,6 +14,16 @@ pub(crate) enum Command {
         #[clap(subcommand)]
         command: npm::Command,
     },
+    /// GitHub Actions-only commands
+    ///
+    /// Subcommands under this namespace assume they run from a GitHub Actions
+    /// workflow with the environment, secrets, and pre-setup (e.g.
+    /// `docker login`) that the workflow provides. They are not expected to
+    /// work from a vanilla local checkout.
+    GithubActions {
+        #[clap(subcommand)]
+        command: github_actions::Command,
+    },
     /// Sync all generated files with Rust source of truth
     Sync {
         /// Fail if git is dirty after syncing (for CI verification)
@@ -26,6 +37,7 @@ impl Command {
         match self {
             Self::Ruby { command } => command.run().await,
             Self::Npm { command } => command.run().await,
+            Self::GithubActions { command } => command.run().await,
             Self::Sync { reject_dirty } => {
                 ruby::sync(*reject_dirty).await?;
                 npm::sync(*reject_dirty).await?;

manager/src/pg_ephemeral/github_actions.rs

@@ -0,0 +1,18 @@
+pub(crate) mod cache_registry;
+
+#[derive(Debug, clap::Parser)]
+pub(crate) enum Command {
+    /// Cache registry end-to-end tests.
+    CacheRegistry {
+        #[clap(subcommand)]
+        command: cache_registry::Command,
+    },
+}
+
+impl Command {
+    pub(crate) async fn run(&self) -> Result<(), Box<dyn std::error::Error>> {
+        match self {
+            Self::CacheRegistry { command } => command.run().await,
+        }
+    }
+}