Tweak CI for Tchap

Author: MatMaul

.github/workflows/build.yaml

@@ -3,7 +3,7 @@ name: Build
 on:
   push:
     branches:
-      - main
+      - tchap
       - "release/**"
     tags:
       - "v*"
@@ -22,8 +22,9 @@ env:
   CARGO_NET_GIT_FETCH_WITH_CLI: "true"
   SCCACHE_GHA_ENABLED: "true"
   RUSTC_WRAPPER: "sccache"
-  IMAGE: ghcr.io/element-hq/matrix-authentication-service
-  BUILDCACHE: ghcr.io/element-hq/matrix-authentication-service/buildcache
+  IMAGE: ghcr.io/tchapgouv/matrix-authentication-service
+  IMAGE_SYN2MAS: ghcr.io/tchapgouv/matrix-authentication-service/syn2mas
+  BUILDCACHE: ghcr.io/tchapgouv/matrix-authentication-service/buildcache
   DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
 
 jobs:
@@ -252,8 +253,24 @@ jobs:
             type=semver,pattern={{major}}
             type=sha
 
+      - name: Docker meta (syn2mas)
+        id: meta-syn2mas
+        uses: docker/[email protected]
+        with:
+          images: "${{ env.IMAGE_SYN2MAS }}"
+          bake-target: docker-metadata-action-syn2mas
+          flavor: |
+            latest=auto
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
+
       - name: Setup Cosign
-        uses: sigstore/[email protected].2
+        uses: sigstore/[email protected].1
 
       - name: Set up Docker Buildx
         uses: docker/[email protected]
@@ -271,12 +288,13 @@ jobs:
 
       - name: Build and push
         id: bake
-        uses: docker/bake-action@v6.6.0
+        uses: docker/bake-action@v6.5.0
         with:
           files: |
             ./docker-bake.hcl
             cwd://${{ steps.meta.outputs.bake-file }}
             cwd://${{ steps.meta-debug.outputs.bake-file }}
+            cwd://${{ steps.meta-syn2mas.outputs.bake-file }}
           set: |
             base.output=type=image,push=true
             base.cache-from=type=registry,ref=${{ env.BUILDCACHE }}:buildcache
@@ -295,16 +313,48 @@ jobs:
         # Only sign on tags and on commits on main branch
         if: |
           github.event_name != 'pull_request'
-          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
+          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/tchap')
 
         env:
           REGULAR_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).regular.digest }}
           DEBUG_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).debug.digest }}
+          SYN2MAS_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).syn2mas.digest }}
 
         run: |-
           cosign sign --yes \
             "$IMAGE@$REGULAR_DIGEST" \
             "$IMAGE@$DEBUG_DIGEST" \
+            "$IMAGE_SYN2MAS@$SYN2MAS_DIGEST"
+
+  syn2mas:
+    name: Release syn2mas on NPM
+    runs-on: ubuntu-24.04
+    if: 'false'
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout the code
+        uses: actions/[email protected]
+
+      - name: Install Node
+        uses: actions/[email protected]
+        with:
+          node-version-file: ./tools/syn2mas/.nvmrc
+
+      - name: Install Node dependencies
+        working-directory: ./tools/syn2mas
+        run: npm ci
+
+      - name: Publish
+        uses: JS-DevTools/npm-publish@v3
+        with:
+          package: ./tools/syn2mas
+          token: ${{ secrets.NPM_TOKEN }}
+          provenance: true
+          dry-run: ${{ !startsWith(github.ref, 'refs/tags/') }}
 
   release:
     name: Release
@@ -313,6 +363,7 @@ jobs:
     needs:
       - assemble-archives
       - build-image
+      - syn2mas
     steps:
       - name: Download the artifacts from the previous job
         uses: actions/download-artifact@v4
@@ -352,14 +403,26 @@ jobs:
                 ') }}
                 ```
 
+            `syn2mas` migration tool:
+
+              - Digest:
+                ```
+                ${{ env.IMAGE_SYN2MAS }}@${{ fromJSON(needs.build-image.outputs.metadata).syn2mas.digest }}
+                ```
+              - Tags:
+                ```
+                ${{ join(fromJSON(needs.build-image.outputs.metadata).syn2mas.tags, '
+                ') }}
+                ```
+
           files: |
             artifacts/mas-cli-aarch64-linux.tar.gz
             artifacts/mas-cli-x86_64-linux.tar.gz
           draft: true
 
   unstable:
     name: Update the unstable release
-    if: github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/tchap'
     runs-on: ubuntu-24.04
 
     needs: