Change done to the container after a restore and perforce migration

.github/scripts/p4d-version/get-current-version.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Extracts the helix-p4d version currently pinned in helix-p4d/Dockerfile
+# and exposes it as the "version" step output.
+set -euo pipefail
+
+DOCKERFILE="helix-p4d/Dockerfile"
+
+VERSION=$(grep -oP 'helix-p4d=\K[^ \\]+' "$DOCKERFILE" | head -1)
+
+if [[ -z "$VERSION" ]]; then
+  echo "Could not find a pinned helix-p4d version in $DOCKERFILE" >&2
+  exit 1
+fi
+
+echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+echo "Currently pinned version: $VERSION"

.github/scripts/p4d-version/get-latest-version.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Downloads the Perforce APT "Packages" index and extracts the latest
+# available helix-p4d version, exposed as the "version" step output.
+set -euo pipefail
+
+PACKAGES_URL="https://package.perforce.com/apt/ubuntu/dists/noble/release/binary-amd64/Packages"
+
+TMP_FILE=$(mktemp)
+trap 'rm -f "$TMP_FILE"' EXIT
+
+curl -fsSL "$PACKAGES_URL" -o "$TMP_FILE"
+
+# Debian control file format: records are separated by a blank line.
+# We keep records where "Package: helix-p4d" is an exact match (so
+# "helix-p4d-doc" etc. are excluded), then read their Version field.
+# If several versions are listed, keep the highest one (version sort).
+LATEST_VERSION=$(awk -v RS='' -F'\n' '
+  {
+    pkg=""; ver="";
+    for (i = 1; i <= NF; i++) {
+      if ($i == "Package: helix-p4d") pkg=$i;
+      if ($i ~ /^Version: /) { ver=$i; sub(/^Version: /, "", ver) }
+    }
+    if (pkg != "") print ver
+  }
+' "$TMP_FILE" | sort -V | tail -1)
+
+if [[ -z "$LATEST_VERSION" ]]; then
+  echo "Could not find the helix-p4d package in the Perforce feed" >&2
+  exit 1
+fi
+
+echo "version=$LATEST_VERSION" >> "$GITHUB_OUTPUT"
+echo "Latest available version: $LATEST_VERSION"

.github/scripts/p4d-version/sync-issue.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Creates (or updates) a GitHub issue tracking the fact that a newer
+# helix-p4d version is available than the one pinned in the Dockerfile.
+#
+# Requires the following environment variables:
+#   GH_TOKEN         - token used by the gh CLI
+#   REPO             - "owner/repo"
+#   CURRENT_VERSION  - version currently pinned in the Dockerfile
+#   LATEST_VERSION   - version currently available from Perforce
+set -euo pipefail
+
+: "${GH_TOKEN:?GH_TOKEN is required}"
+: "${REPO:?REPO is required}"
+: "${CURRENT_VERSION:?CURRENT_VERSION is required}"
+: "${LATEST_VERSION:?LATEST_VERSION is required}"
+
+LABEL="p4d-update"
+
+# Make sure the label exists (no-op if it already does)
+gh label create "$LABEL" \
+  --color "FBCA04" \
+  --description "A newer helix-p4d version is available from Perforce" \
+  --force || true
+
+# Look for an already-open issue carrying this label
+EXISTING_ISSUE=$(gh issue list \
+  --repo "$REPO" \
+  --label "$LABEL" \
+  --state open \
+  --json number,title,body \
+  --jq '.[0]')
+
+if [[ -z "$EXISTING_ISSUE" || "$EXISTING_ISSUE" == "null" ]]; then
+  echo "No open issue found, creating a new one."
+  ISSUE_BODY=$(printf '%s\n' \
+    "A newer version of the \`helix-p4d\` package is available from the Perforce repository." \
+    "" \
+    "- Version currently pinned in \`helix-p4d/Dockerfile\`: \`$CURRENT_VERSION\`" \
+    "- Available version: \`$LATEST_VERSION\`" \
+    "" \
+    "The \`apt-get install\` line in the Dockerfile should be updated accordingly (also double-check the \`helix-swarm-triggers\` version if relevant)." \
+    "" \
+    "Source: https://package.perforce.com/apt/ubuntu/dists/noble/release/binary-amd64/Packages" \
+    "" \
+    "_This issue was created automatically by the \`check-p4d-version.yml\` workflow._")
+
+  gh issue create \
+    --repo "$REPO" \
+    --title "helix-p4d: newer version available ($LATEST_VERSION)" \
+    --label "$LABEL" \
+    --body "$ISSUE_BODY"
+  exit 0
+fi
+
+ISSUE_NUMBER=$(echo "$EXISTING_ISSUE" | jq -r '.number')
+ISSUE_TEXT=$(echo "$EXISTING_ISSUE" | jq -r '.title + "\n" + .body')
+
+# Also check existing comments so the same version isn't posted twice
+ALREADY_MENTIONED=$(gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json comments --jq '.comments[].body' | grep -F "$LATEST_VERSION" || true)
+
+if echo "$ISSUE_TEXT" | grep -qF "$LATEST_VERSION" || [[ -n "$ALREADY_MENTIONED" ]]; then
+  echo "Version $LATEST_VERSION is already mentioned on issue #$ISSUE_NUMBER, nothing to do."
+  exit 0
+fi
+
+echo "Issue #$ISSUE_NUMBER is already open for an earlier version, adding a comment."
+gh issue comment "$ISSUE_NUMBER" \
+  --repo "$REPO" \
+  --body "Update: an even newer version is now available: \`$LATEST_VERSION\` (currently pinned version: \`$CURRENT_VERSION\`)."

.github/scripts/release/create-release-tag.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Reads the helix-p4d version pinned in the Dockerfile at the current
+# commit (main), looks at existing git tags to find the next available
+# release number (rX), then creates and pushes an immutable annotated
+# tag "<perforce_version>-rX" pointing at the current commit.
+#
+# This tag is what triggers the actual build+push workflow (release.yml).
+# Because each rX gets its own dedicated, never-moved git tag, it is
+# always possible to trace back which exact commit a given release was
+# built from, e.g. `git show 2026.1-2972966-r1`.
+set -euo pipefail
+
+DOCKERFILE="helix-p4d/Dockerfile"
+
+PERFORCE_VERSION=$(grep -oP 'helix-p4d=\K[^ \\]+' "$DOCKERFILE" | head -1 | sed 's/~.*//')
+if [[ -z "$PERFORCE_VERSION" ]]; then
+  echo "Could not find a pinned helix-p4d version in $DOCKERFILE" >&2
+  exit 1
+fi
+echo "Perforce version pinned in Dockerfile: $PERFORCE_VERSION"
+
+git fetch origin --tags --force
+
+LAST_R=$( (git tag -l "${PERFORCE_VERSION}-r*" \
+  | grep -E "^${PERFORCE_VERSION}-r[0-9]+$" \
+  | sed -E "s/^${PERFORCE_VERSION}-r([0-9]+)$/\1/" \
+  | sort -n | tail -1) || true)
+
+if [[ -z "$LAST_R" ]]; then
+  NEXT_R=1
+else
+  NEXT_R=$((LAST_R + 1))
+fi
+
+NEW_TAG="${PERFORCE_VERSION}-r${NEXT_R}"
+echo "Next release tag: $NEW_TAG"
+
+git config user.name "github-actions[bot]"
+git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+git tag -a "$NEW_TAG" -m "Release $NEW_TAG"
+git push origin "$NEW_TAG"
+
+echo "tag=$NEW_TAG" >> "$GITHUB_OUTPUT"
+echo "Pushed tag $NEW_TAG. Triggering the release workflow explicitly next."

.github/scripts/release/validate-and-parse-tag.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Validates the git tag that triggered this workflow (normally created by
+# the "Create Release Tag" workflow) and extracts version info from it.
+# Expected format: <year>.<release>-<build>-r<N>, e.g. 2026.1-2972966-r2
+#
+# Also checks, as defense in depth in case a tag was ever pushed manually
+# instead of through the "Create Release Tag" workflow:
+#   - the tagged commit is an ancestor of main
+#   - the Perforce version embedded in the tag matches what's pinned in
+#     the Dockerfile at that commit
+#
+# Exposes: perforce_version, short_version, release_number, image_name,
+# tags (multiline list of docker tags to build & push)
+set -euo pipefail
+
+TAG="${RELEASE_TAG:-${GITHUB_REF_NAME:-}}"
+DOCKERFILE="helix-p4d/Dockerfile"
+
+if [[ -z "$TAG" ]]; then
+  echo "No release tag provided. Set RELEASE_TAG for workflows triggered manually; tag-triggered workflows use GITHUB_REF_NAME." >&2
+  exit 1
+fi
+
+if [[ ! "$TAG" =~ ^(([0-9]{4}\.[0-9]+)-([0-9]+))-r([0-9]+)$ ]]; then
+  echo "Tag '$TAG' does not match the expected <year>.<release>-<build>-r<N> format (e.g. 2026.1-2972966-r2)" >&2
+  exit 1
+fi
+
+PERFORCE_VERSION="${BASH_REMATCH[1]}"
+SHORT_VERSION="${BASH_REMATCH[2]}"
+RELEASE_NUMBER="${BASH_REMATCH[4]}"
+
+echo "Tag: $TAG"
+echo "Perforce version: $PERFORCE_VERSION"
+echo "Short version: $SHORT_VERSION"
+echo "Release number: r$RELEASE_NUMBER"
+
+if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+  echo "Commit $GITHUB_SHA (tag $TAG) is not an ancestor of main. Refusing to publish." >&2
+  exit 1
+fi
+
+DOCKERFILE_VERSION=$(grep -oP 'helix-p4d=\K[^ \\]+' "$DOCKERFILE" | head -1 | sed 's/~.*//')
+if [[ "$DOCKERFILE_VERSION" != "$PERFORCE_VERSION" ]]; then
+  echo "Tag ($PERFORCE_VERSION) does not match the version pinned in $DOCKERFILE at this commit ($DOCKERFILE_VERSION)" >&2
+  exit 1
+fi
+
+OWNER_LOWER=$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')
+IMAGE_NAME="ghcr.io/${OWNER_LOWER}/helix-p4d"
+CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+{
+  echo "perforce_version=$PERFORCE_VERSION"
+  echo "short_version=$SHORT_VERSION"
+  echo "release_number=$RELEASE_NUMBER"
+  echo "image_name=$IMAGE_NAME"
+  echo "created=$CREATED"
+  echo "tags<<TAGS_EOF"
+  echo "${IMAGE_NAME}:${TAG}"
+  echo "${IMAGE_NAME}:latest"
+  echo "${IMAGE_NAME}:${SHORT_VERSION}"
+  echo "TAGS_EOF"
+} >> "$GITHUB_OUTPUT"

.github/workflows/check-p4d-version.yml

@@ -0,0 +1,39 @@
+name: Check helix-p4d Version
+
+on:
+  schedule:
+    # Every Sunday at 20:00 UTC
+    - cron: '0 20 * * 0'
+  workflow_dispatch: {}
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Extract current pinned version from Dockerfile
+        id: current
+        run: bash .github/scripts/p4d-version/get-current-version.sh
+
+      - name: Fetch latest available version from Perforce repo
+        id: latest
+        run: bash .github/scripts/p4d-version/get-latest-version.sh
+
+      - name: Compare versions and manage issue
+        if: steps.current.outputs.version != steps.latest.outputs.version
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CURRENT_VERSION: ${{ steps.current.outputs.version }}
+          LATEST_VERSION: ${{ steps.latest.outputs.version }}
+          REPO: ${{ github.repository }}
+        run: bash .github/scripts/p4d-version/sync-issue.sh
+
+      - name: No update needed
+        if: steps.current.outputs.version == steps.latest.outputs.version
+        run: echo "Pinned version (${{ steps.current.outputs.version }}) is already up to date, nothing to do."

.github/workflows/create-release-tag-and-build-image.yml

@@ -0,0 +1,58 @@
+name: Create Release Tag and Build Image
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      # Always operate on main regardless of which branch was selected
+      # in the "Run workflow" dropdown.
+      - name: Checkout main
+        uses: actions/checkout@v7
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Create and push release tag
+        id: tag
+        run: bash .github/scripts/release/create-release-tag.sh
+
+      - name: Ensure main history is available
+        run: git fetch origin main:refs/remotes/origin/main
+
+      - name: Validate tag and extract version info
+        id: version
+        env:
+          RELEASE_TAG: ${{ steps.tag.outputs.tag }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: bash .github/scripts/release/validate-and-parse-tag.sh
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push image
+        uses: docker/build-push-action@v7
+        with:
+          context: ./helix-p4d
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.version.outputs.tags }}
+          labels: |
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ steps.tag.outputs.tag }}
+            org.opencontainers.image.created=${{ steps.version.outputs.created }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/docker-build-check.yml

@@ -0,0 +1,31 @@
+name: Docker Build Check
+
+on:
+  pull_request:
+    branches: [main]
+
+# Cancel any in-progress runs of this workflow for the same pull request number
+concurrency:
+  group: docker-build-check-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build helix-p4d image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build image (no push)
+        uses: docker/build-push-action@v7
+        with:
+          context: ./helix-p4d
+          platforms: linux/amd64
+          push: false
+          tags: helix-p4d:ci-${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max