@@ -18,6 +18,10 @@ on:
         description: Push to a scratch repository and create no public tag
         type: boolean
         default: false
+      dry_run_hub:
+        description: With dry_run, also copy to the Docker Hub scratch repository
+        type: boolean
+        default: false
   schedule:
     - cron: "30 05 * * *"  # 08:30 PM UTC everyday
 
@@ -37,6 +41,10 @@ env:
   GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/archlinux
   HUB_IMAGE: pkgforge/archlinux
   SCRATCH_IMAGE: ghcr.io/${{ github.repository_owner }}/archlinux-ci
+  # The Docker Hub side of a dry run. Copying across registries is the one part
+  # of the publish that a GHCR-only dry run cannot reach, so it needs a scratch
+  # repository of its own on the other registry.
+  HUB_SCRATCH_IMAGE: pkgforge/archlinux-ci
 
 #------------------------------------------------------------------------------------#
 jobs:
@@ -53,6 +61,7 @@ jobs:
       build_date: ${{ steps.inputs.outputs.build_date }}
       anchors: ${{ steps.inputs.outputs.anchors }}
       target_image: ${{ steps.inputs.outputs.target_image }}
+      hub_image: ${{ steps.inputs.outputs.hub_image }}
       publish_hub: ${{ steps.inputs.outputs.publish_hub }}
     steps:
       - name: Checkout
@@ -64,22 +73,44 @@ jobs:
         id: inputs
         env:
           DRY_RUN: ${{ inputs.dry_run }}
+          DRY_RUN_HUB: ${{ inputs.dry_run_hub }}
         run: |
           set -euo pipefail
           version="$(date -u +'%Y.%m.%d')"
           build_date="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          echo "build_date=$build_date" >> "$GITHUB_OUTPUT"
+
+          # ⛔ dry_run_hub only makes sense inside a dry run. Without this guard
+          # a run with dry_run_hub alone would take the real branch and read as
+          # though it had tested something.
+          if [ "${DRY_RUN_HUB:-false}" = "true" ] && [ "${DRY_RUN:-false}" != "true" ]; then
+            echo "dry_run_hub needs dry_run. On its own it would publish to the real repositories." >&2
+            exit 1
+          fi
 
           if [ "${DRY_RUN:-false}" = "true" ]; then
-            echo "target_image=${SCRATCH_IMAGE}" >> "$GITHUB_OUTPUT"
-            echo "publish_hub=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::dry run, building into ${SCRATCH_IMAGE} and creating no public tag"
+            target_image="$SCRATCH_IMAGE"
+            hub_image="$HUB_SCRATCH_IMAGE"
+            if [ "${DRY_RUN_HUB:-false}" = "true" ]; then
+              publish_hub=true
+              echo "::notice::dry run into ${SCRATCH_IMAGE} and ${HUB_SCRATCH_IMAGE}, exercising the cross-registry copy, creating no public tag"
+            else
+              publish_hub=false
+              echo "::notice::dry run, building into ${SCRATCH_IMAGE} and creating no public tag"
+            fi
           else
-            echo "target_image=${GHCR_IMAGE}" >> "$GITHUB_OUTPUT"
-            echo "publish_hub=true" >> "$GITHUB_OUTPUT"
+            target_image="$GHCR_IMAGE"
+            hub_image="$HUB_IMAGE"
+            publish_hub=true
           fi
 
+          {
+            echo "version=$version"
+            echo "build_date=$build_date"
+            echo "target_image=$target_image"
+            echo "hub_image=$hub_image"
+            echo "publish_hub=$publish_hub"
+          } >> "$GITHUB_OUTPUT"
+
           # The anchor names the pinned tag family. The ports are not in
           # lockstep, so it is resolved per architecture.
           anchors='{'
@@ -282,14 +313,15 @@ jobs:
       - name: Create the per architecture tags
         env:
           TARGET_IMAGE: ${{ needs.resolve.outputs.target_image }}
+          HUB_TARGET: ${{ needs.resolve.outputs.hub_image }}
           PUBLISH_HUB: ${{ needs.resolve.outputs.publish_hub }}
           VERSION: ${{ needs.resolve.outputs.version }}
           ANCHORS: ${{ needs.resolve.outputs.anchors }}
         run: |
           set -euo pipefail
           images=("$TARGET_IMAGE")
           if [ "$PUBLISH_HUB" = "true" ]; then
-            images+=("$HUB_IMAGE")
+            images+=("$HUB_TARGET")
           fi
           for arch in amd64 arm64 armv7 riscv64; do
             digest_file="/tmp/digests/$arch"
@@ -312,13 +344,14 @@ jobs:
       - name: Create the index tags
         env:
           TARGET_IMAGE: ${{ needs.resolve.outputs.target_image }}
+          HUB_TARGET: ${{ needs.resolve.outputs.hub_image }}
           PUBLISH_HUB: ${{ needs.resolve.outputs.publish_hub }}
           VERSION: ${{ needs.resolve.outputs.version }}
         run: |
           set -euo pipefail
           images=("$TARGET_IMAGE")
           if [ "$PUBLISH_HUB" = "true" ]; then
-            images+=("$HUB_IMAGE")
+            images+=("$HUB_TARGET")
           fi
           sources=()
           for arch in amd64 arm64 armv7 riscv64; do
@@ -335,31 +368,52 @@ jobs:
       - name: Verify what was published
         env:
           TARGET_IMAGE: ${{ needs.resolve.outputs.target_image }}
+          HUB_TARGET: ${{ needs.resolve.outputs.hub_image }}
+          PUBLISH_HUB: ${{ needs.resolve.outputs.publish_hub }}
           VERSION: ${{ needs.resolve.outputs.version }}
         run: |
           set -euo pipefail
-          # The dated index tag carries a leading v. scripts/tag-names is the
-          # authority on the spelling, so it is asked rather than reconstructed:
-          # inspecting a tag the publish job never created would fail every run.
-          dated="$(scripts/tag-names index "$VERSION" "$TARGET_IMAGE" | grep -v ':latest$')"
-          echo "verifying $dated"
-
-          # The index must carry all four platforms. An index with a hole in it
-          # is the failure this whole topology exists to prevent.
-          got="$(docker buildx imagetools inspect "$dated" --raw \
-            | jq -r '[ .manifests[].platform
-                       | select(.os != "unknown")
-                       | .architecture + (if .variant then "/" + .variant else "" end) ]
-                     | sort | join(" ")')"
-          echo "index platforms: $got"
-
-          # armv7 renders as arm/v7. A bare match on arm would also match arm64,
-          # so the assertion would pass with armv7 missing and mean nothing.
-          for expect in amd64 arm64 riscv64 arm/v7; do
-            if ! grep -qw -- "$expect" <<< "$got"; then
-              echo "the index for $dated is missing $expect" >&2
-              echo "it carries: $got" >&2
-              exit 1
-            fi
-          done
-          echo "::notice::published $dated with platforms $got"
+
+          # ⛔ Both registries are verified, not just the one the digests were
+          # staged on. Copying across registries is a separate operation that can
+          # fail on its own, and until this step covered it a Docker Hub tag that
+          # never arrived, or arrived without every platform, ended a green run.
+          verify_index() {
+            local image="$1" dated got expect
+            # The dated index tag carries a leading v. scripts/tag-names is the
+            # authority on the spelling, so it is asked rather than
+            # reconstructed: inspecting a tag the publish job never created
+            # would fail every run.
+            dated="$(scripts/tag-names index "$VERSION" "$image" | grep -v ':latest$')"
+            echo "verifying $dated"
+
+            # The index must carry all four platforms. An index with a hole in
+            # it is the failure this whole topology exists to prevent.
+            got="$(docker buildx imagetools inspect "$dated" --raw \
+              | jq -r '[ .manifests[].platform
+                         | select(.os != "unknown")
+                         | .architecture + (if .variant then "/" + .variant else "" end) ]
+                       | sort | join(" ")')"
+            echo "index platforms: $got"
+
+            # armv7 renders as arm/v7. A bare match on arm would also match
+            # arm64, so the assertion would pass with armv7 missing and mean
+            # nothing.
+            for expect in amd64 arm64 riscv64 arm/v7; do
+              if ! grep -qw -- "$expect" <<< "$got"; then
+                echo "the index for $dated is missing $expect" >&2
+                echo "it carries: $got" >&2
+                echo "the digests were staged on ${TARGET_IMAGE}. If that index is" >&2
+                echo "complete and this one is not, the cross-registry copy is what failed." >&2
+                exit 1
+              fi
+            done
+            echo "::notice::published $dated with platforms $got"
+          }
+
+          verify_index "$TARGET_IMAGE"
+          if [ "$PUBLISH_HUB" = "true" ]; then
+            verify_index "$HUB_TARGET"
+          else
+            echo "::notice::publish_hub is false, so no Docker Hub tag was created or verified"
+          fi
@@ -30,6 +30,10 @@ fault, and pointing `REPO_ROOT` at that directory.
 | `25` | the `grep -c` form restored at `scripts/gen-mirrorlist:278` | `not ok 1`, naming the file and line |
 | `25` | the `grep -c` form restored at `.github/workflows/freshness-mirrors.yml:47` | `not ok 2 - none of the 5 workflows uses a pipeline that fails on a normal result` |
 | `30-signature-checking-on.sh` | `SigLevel = Never` in `rootfs/riscv64/etc/pacman.conf` | `not ok 7 - does not disable signature checking`, `not ok 8 - sets SigLevel = Required` |
+| `35-publish-targets.sh` | a tag-creating step changed back to `images+=("$HUB_IMAGE")` | `not ok 4 - no tag-creating step names GHCR_IMAGE or HUB_IMAGE directly`, naming both lines |
+| `35` | `HUB_SCRATCH_IMAGE` set to `pkgforge/archlinux`, the real repository | `not ok 3 - HUB_SCRATCH_IMAGE names a different repository from HUB_IMAGE` |
+| `35` | the `dry_run_hub needs dry_run` guard deleted | `not ok 5 - the resolve step refuses dry_run_hub without dry_run` |
+| `35` | the `verify_index "$HUB_TARGET"` call deleted | `not ok 6 - the publish job verifies the index on both registries`, `matched 1 of the 2` |
 | `40-mirrors-reachable.sh` | the riscv64 list cut to one server, which is the shape that caused the outage | `not ok 11 - offers a fallback server`, `not ok 16 - keeps at least 2 reachable servers` |
 | `40` | ten of thirteen amd64 servers replaced with unresolvable hosts | `not ok 13 - keeps at least 7 reachable servers` |
 | `50-supply-chain.sh` | `actions/checkout@v7.0.1` at all three call sites | `not ok 1..3 - action is pinned to a commit hash at ...` |
 
@@ -23,6 +23,7 @@ reproduces it. Exit status is non-zero when any assertion fails.
 | `20-no-swallowed-errors.sh` | no `continue-on-error`, `\|\| true`, `set +e` or `2>/dev/null` in the workflows, the Dockerfile or `scripts/`, outside `tests/policy/swallowed-errors.allow` |
 | `25-pipeline-traps.sh` | no script that sets `pipefail`, and no workflow `run` block, pipes into `head` or counts with a `grep` count flag. Both fail on a result that is normal, and both stop the script with no message |
 | `30-signature-checking-on.sh` | every shipped `pacman.conf` sets `SigLevel = Required` and none sets any SigLevel to `Never` |
+| `35-publish-targets.sh` | a dry run cannot reach a real repository: each scratch name differs from its real counterpart, no tag-creating step names `GHCR_IMAGE` or `HUB_IMAGE` directly, `dry_run_hub` is refused without `dry_run`, and the publish job verifies the index on both registries |
 | `40-mirrors-reachable.sh` | each list carries a generation date and is within the age bound, ships a fallback server and at least one over https, and keeps at least two reachable servers and at least half of what it ships. Every entry that does not answer 200 is named as a diagnostic |
 | `50-supply-chain.sh` | every action is pinned to a commit hash and names its version, nothing pipes a remote script into a shell, no opaque binary is fetched and made executable, no deprecated workflow command, every workflow declares least-privilege `permissions` |
 | `60-tag-families.sh` | `scripts/tag-names` emits every alias for each architecture on both registry names, each with a rolling, a dated and a pinned shape, plus the `latest` and `v<version>` index tags, with no alias claimed twice and an unknown architecture or empty version refused |
 
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+#
+# A dry run must not be able to reach a real repository.
+#
+# The publish job creates tags from a resolved target name. A dry run resolves
+# that name to a scratch repository on each registry. ⛔ The failure this guards
+# is one edit away: if a tag-creating step goes back to naming HUB_IMAGE
+# directly instead of the resolved output, a dry run keeps its scratch name on
+# GHCR and writes real tags to Docker Hub. Nothing about the run would look
+# wrong, and the tags would be public.
+#
+# ⚠ This reads the workflow rather than running it. What it cannot check is
+# whether the resolve step's branches are correct; that is checked by running
+# the workflow with dry_run and dry_run_hub, recorded in
+# HISTORY/tests-seen-to-fail.md.
+set -euo pipefail
+# shellcheck source-path=SCRIPTDIR/..
+# shellcheck source=lib/harness.sh
+. "$REPO_ROOT/tests/lib/harness.sh"
+
+WF="$REPO_ROOT/.github/workflows/build-deploy.yml"
+
+if [ ! -f "$WF" ]; then
+  fail "the build workflow exists" \
+    "expected: $WF" \
+    "reproduce: ls .github/workflows/build-deploy.yml"
+  summary
+  exit 1
+fi
+ok "the build workflow exists"
+
+# value NAME -> the value of a top level env entry
+value() {
+  awk -v k="$1" '$1 == k":" { sub(/^[^:]*:[[:space:]]*/, ""); print; exit }' "$WF"
+}
+
+ghcr="$(value GHCR_IMAGE)"
+hub="$(value HUB_IMAGE)"
+scratch="$(value SCRATCH_IMAGE)"
+hub_scratch="$(value HUB_SCRATCH_IMAGE)"
+
+#---------------------------------------------------------------------------#
+# 1. Four names, and each real one differs from its scratch counterpart.
+#---------------------------------------------------------------------------#
+for pair in "GHCR_IMAGE:$ghcr:SCRATCH_IMAGE:$scratch" "HUB_IMAGE:$hub:HUB_SCRATCH_IMAGE:$hub_scratch"; do
+  IFS=: read -r rn rv sn sv <<< "$pair"
+  if [ -z "$rv" ] || [ -z "$sv" ]; then
+    fail "$rn and $sn are both set" \
+      "$rn=${rv:-<unset>}, $sn=${sv:-<unset>}" \
+      "reproduce: grep -nE '^  (GHCR|HUB|SCRATCH|HUB_SCRATCH)_IMAGE:' .github/workflows/build-deploy.yml"
+  elif [ "$rv" = "$sv" ]; then
+    fail "$sn names a different repository from $rn" \
+      "both are $rv" \
+      "a dry run would then write to the repository consumers pull" \
+      "reproduce: grep -nE '^  (GHCR|HUB|SCRATCH|HUB_SCRATCH)_IMAGE:' .github/workflows/build-deploy.yml"
+  else
+    ok "$sn ($sv) is not $rn ($rv)"
+  fi
+done
+
+#---------------------------------------------------------------------------#
+# 2. No step that creates a tag names a real repository directly.
+#
+# The tag steps must build their image list from the resolved outputs. A
+# reference to HUB_IMAGE or GHCR_IMAGE inside one of them bypasses the dry run.
+#---------------------------------------------------------------------------#
+direct="$(awk '
+  /^      - name: Create the (per architecture|index) tags$/ { instep = 1; next }
+  /^      - name: / { instep = 0 }
+  instep && /\$(\{)?(HUB_IMAGE|GHCR_IMAGE)/ { printf "%d: %s\n", NR, $0 }
+' "$WF")"
+
+if [ -z "$direct" ]; then
+  ok "no tag-creating step names GHCR_IMAGE or HUB_IMAGE directly"
+else
+  fail "no tag-creating step names GHCR_IMAGE or HUB_IMAGE directly" \
+    "found: $(printf '%s' "$direct" | tr '\n' ' ')" \
+    "these steps must use the resolved target_image and hub_image outputs" \
+    "naming the real repository here makes a dry run publish real tags" \
+    "reproduce: grep -n 'HUB_IMAGE\|GHCR_IMAGE' .github/workflows/build-deploy.yml"
+fi
+
+#---------------------------------------------------------------------------#
+# 3. dry_run_hub cannot be used on its own.
+#---------------------------------------------------------------------------#
+if grep -q 'dry_run_hub needs dry_run' "$WF"; then
+  ok "the resolve step refuses dry_run_hub without dry_run"
+else
+  fail "the resolve step refuses dry_run_hub without dry_run" \
+    "the guard is not present" \
+    "without it, dry_run_hub alone takes the real branch and looks like a test" \
+    "reproduce: grep -n 'dry_run_hub' .github/workflows/build-deploy.yml"
+fi
+
+#---------------------------------------------------------------------------#
+# 4. Both registries are verified after publishing.
+#
+# Copying across registries is its own operation and can fail on its own. A
+# verification that only inspects the staging registry passes while the other
+# one carries nothing.
+#---------------------------------------------------------------------------#
+verify_block="$(awk '
+  /^      - name: Verify what was published$/ { instep = 1 }
+  instep && /^      - name: / && !/Verify what was published/ { instep = 0 }
+  instep { print }
+' "$WF")"
+
+if [ -z "$verify_block" ]; then
+  fail "the publish job verifies what it published" \
+    "no 'Verify what was published' step found" \
+    "reproduce: grep -n 'Verify what was published' .github/workflows/build-deploy.yml"
+else
+  hits=0
+  printf '%s\n' "$verify_block" | grep -q 'verify_index "\$TARGET_IMAGE"' && hits=$((hits + 1))
+  printf '%s\n' "$verify_block" | grep -q 'verify_index "\$HUB_TARGET"' && hits=$((hits + 1))
+  if [ "$hits" -eq 2 ]; then
+    ok "the publish job verifies the index on both registries"
+  else
+    fail "the publish job verifies the index on both registries" \
+      "matched $hits of the 2 expected verify_index calls" \
+      "a run that copied nothing to the second registry would still be green" \
+      "reproduce: sed -n '/Verify what was published/,/^\$/p' .github/workflows/build-deploy.yml"
+  fi
+fi
+
+summary