Add ECR Public mirroring for slim images via dispatch

[avallete]

Summary

This change adds automated mirroring of slim images from GHCR to AWS ECR Public by leveraging the existing mirror infrastructure in the supabase/cli repository. Images are mirrored via a repository_dispatch event, with verification that the destination digest matches the source before releasing.

Key Changes

• New scripts/ecr-mirror.sh: Main script providing four subcommands:

  • payload: Renders a repository_dispatch request body for a single release
  • request: Sends the dispatch event and polls the destination until the digest matches
  • verify: Polls the destination until the digest matches (no-op if already synced)
  • sync: Compares all published releases against ECR Public and reports drift; with --request flag, dispatches mirror requests for missing/mismatched tags

• New scripts/test-ecr-mirror.sh: Comprehensive test suite validating:

  • Payload rendering with correct event type and client payload structure
  • Environment variable overrides for prefixes and event types
  • Validation of service names, version patterns, and digest formats
  • Token requirement enforcement when destination is stale

• New .github/workflows/ecr-mirror-check.yml: Daily scheduled workflow that:

  • Checks all published releases against ECR Public
  • Optionally dispatches mirror requests for out-of-sync tags via manual trigger
  • Fails if any release is missing or has a mismatched digest

• Updated service-release.yml:

  • Added mirror-ecr job that runs after publish-image
  • Downloads published image metadata and installs regctl for digest verification
  • Requests ECR mirror via dispatch and verifies the destination digest matches
  • Appends ECR Public references to release notes when mirroring succeeds
  • Made publish-release depend on mirror-ecr to ensure releases only happen when both registries are in sync

• New docs/design/ecr-mirror-dispatch.md: Design documentation covering:

  • The complete mirroring flow and dispatch contract
  • Setup checklist for enabling the feature
  • Rationale for the cli/ namespace in ECR Public

• Updated test infrastructure: Added test-ecr-mirror.sh to the repository checks workflow

Implementation Details

• The script uses regctl for anonymous digest verification, avoiding the need for ECR credentials in this repository
• Mirroring is skipped gracefully (with a workflow notice) until CLI_MIRROR_DISPATCH_TOKEN is configured
• Once configured, a failed mirror fails the entire release workflow
• The dispatch contract validates that source and destination are within expected prefixes and that the source resolves to the expected digest before copying
• Polling timeout defaults to 900 seconds (15 minutes) with 30-second intervals, both configurable via environment variables
• The sync command can be used for backfilling existing releases that predate the mirroring feature

https://claude.ai/code/session_01YaJgsq9xTCpMnEhqesr87S