ci: delegate image publishing to Argo

[Johnaverse]

Summary

• Add the repository-owned Argo build profile.
• Keep pull-request lint, tests, coverage, and OpenAPI drift validation.
• Remove hosted Docker build and GHCR publication.
• Bump the application and OpenAPI version to 1.7.36.
• Replace expired future-date fixtures with stable future dates.

Coordinated rollout

Pair with the johnaverse-fleet PR that enables chains-api in the Argo build poller.

Validation

• lint passed
• Vitest coverage: 1,147 passed, 4 skipped
• generated OpenAPI document matches version 1.7.36
• build profile validation passed
• actionlint and YAML parsing passed
• git diff --check and added-line secret scan passed

[Copilot]

🟡 Changes recommended

The CI workflow trigger/pipeline changes appear to diverge from repository documentation and remove any visible SonarQube scan path, which should be reconciled or documented before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR shifts container image publishing responsibilities from GitHub Actions to an Argo-driven build/poller workflow by introducing a repo-owned build profile, while retaining pull-request verification (lint/tests/coverage/OpenAPI drift checks). It also bumps the service/OpenAPI version to 1.7.36 and updates time-sensitive test fixtures to stable future dates.

Changes:

• Add .johnaverse/build.yaml to describe the Argo build inputs (version source + Docker image build context).
• Convert the existing Docker workflow into PR-only checks by removing GHCR build/publish and push/tag triggers.
• Bump version to 1.7.36 across package.json, package-lock.json, and public/openapi.json, and refresh fork test fixtures to avoid expiring dates.

File summaries

File	Description
tests/unit/services/forks.test.js	Updates fork activation fixture dates to stable far-future timestamps to keep tests from expiring.
public/openapi.json	Bumps the published OpenAPI info.version to 1.7.36.
package.json	Bumps application version to 1.7.36.
package-lock.json	Keeps lockfile metadata in sync with the 1.7.36 version bump.
.johnaverse/build.yaml	Adds an Argo build profile describing the image build context and version source.
.github/workflows/docker-build.yml	Removes Docker build/push and narrows the workflow to PR checks + manual dispatch.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.