M7.6: nisse-review's image

A `review` target in the Dockerfile: its own user (nisse-review, uid
10002), git for its clones, state and clones in /var/lib/nisse-review,
configuration at /etc/nisse-review, and only its own agent installed.
release.yml publishes gitea.dongar.net/dev/nisse-review beside nisse-dev,
at the same version. review-bringup.sh builds and runs the image, as
bringup.sh runs nisse-dev's.

The test stage adds an agent package its base lacks, without its
dependencies, since the suite's own code imports every agent's. Without
that, the tests over nisse-dev's image no longer import since
test_review_live arrived. tests/deploy/test_images.py checks the image and
that the test stage leaves what it installed as it was.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

.gitea/workflows/release.yml

@@ -1,7 +1,11 @@
 name: Release
-# A published release builds the agent's image and pushes it to Gitea's
-# registry (Development Plan M1.5, X4): gitea.dongar.net/dev/nisse-dev
-# tagged with the version (the release tag without its v) and latest. Cut a
+# A published release builds every agent's image and pushes it to Gitea's
+# registry (Development Plan M1.5, M7.6, X4): gitea.dongar.net/dev/nisse-dev
+# and gitea.dongar.net/dev/nisse-review, each tagged with the version (the
+# release tag without its v) and latest. One release, one version for all:
+# the agents share nisse-core and were tested together. Older versions are
+# removed by the dev organization's package cleanup rule (keep the 10 most
+# recent, and latest), set in Gitea, not here. Cut a
 # release in Gitea (Releases → New release, tag vX.Y.Z); a tag pushed for any
 # other reason builds nothing. The full test set runs first: no image without
 # it passing.
@@ -22,6 +26,7 @@ env:
   REGISTRY: gitea.dongar.net
   REGISTRY_USER: registry-push  # the token's account
   IMAGE: gitea.dongar.net/dev/nisse-dev
+  REVIEW_IMAGE: gitea.dongar.net/dev/nisse-review
 
 jobs:
   tests:
@@ -87,7 +92,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build and push the agent
+      - name: Build and push nisse-dev
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -101,3 +106,18 @@ jobs:
           tags: |
             ${{ env.IMAGE }}:${{ steps.vars.outputs.version }}
             ${{ env.IMAGE }}:latest
+
+      - name: Build and push nisse-review
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          target: review
+          push: true
+          build-args: |
+            VERSION=${{ steps.vars.outputs.version }}
+          labels: |
+            org.opencontainers.image.version=${{ steps.vars.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
+          tags: |
+            ${{ env.REVIEW_IMAGE }}:${{ steps.vars.outputs.version }}
+            ${{ env.REVIEW_IMAGE }}:latest