From 85da928019c428faf43cf96785f16f7da9efb0df Mon Sep 17 00:00:00 2001
From: Chris Sherwood <chris@crosstalksolutions.com>
Date: Mon, 31 Aug 2026 12:48:54 -0700
Subject: [PATCH] ci: add Build Translate Proxy Image workflow

workflow_dispatch workflows are only dispatchable if the file exists on
the default branch, so this must land on main before the translate proxy
image can be published.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F8Mgg1vd2eKSs8StZiuyMV
---
 .github/workflows/build-translate-proxy.yml | 52 +++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/build-translate-proxy.yml

diff --git a/.github/workflows/build-translate-proxy.yml b/.github/workflows/build-translate-proxy.yml
new file mode 100644
index 00000000..d0b7d650
--- /dev/null
+++ b/.github/workflows/build-translate-proxy.yml
@@ -0,0 +1,52 @@
+name: Build Translate Proxy Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Semantic version to label the Docker image under (no "v" prefix, e.g. "1.2.3")'
+        required: true
+        type: string
+      tag_latest:
+        description: 'Also tag this image as :latest?'
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  check_authorization:
+    name: Check authorization to publish new Docker image
+    runs-on: ubuntu-latest
+    outputs:
+      isAuthorized: ${{ steps.check-auth.outputs.is_authorized }}
+    steps:
+      - name: check-auth
+        id: check-auth
+        run: echo "is_authorized=${{ contains(secrets.DEPLOYMENT_AUTHORIZED_USERS, github.triggering_actor) }}" >> $GITHUB_OUTPUT
+  build:
+    name: Build translate-proxy image
+    needs: check_authorization
+    if: needs.check_authorization.outputs.isAuthorized == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: install/nomad-translate
+          platforms: linux/amd64
+          push: true
+          tags: |
+            ghcr.io/crosstalk-solutions/project-nomad-translate:${{ inputs.version }}
+            ghcr.io/crosstalk-solutions/project-nomad-translate:v${{ inputs.version }}
+            ${{ inputs.tag_latest && 'ghcr.io/crosstalk-solutions/project-nomad-translate:latest' || '' }}