Add shared workflow for Heroku container deploys

.github/workflows/heroku-container.yml

@@ -0,0 +1,120 @@
+name: Heroku container deploy
+
+on:
+  workflow_call:
+    inputs:
+      heroku-app:
+        description: "The Heroku app name"
+        default: ${{ github.event.repository.name }}
+        required: false
+        type: string
+      branch:
+        description: "The branch to deploy"
+        default: ${{ github.event.repository.default_branch }}
+        required: false
+        type: string
+      targets:
+        description: "Space-separated Dockerfile targets to build and push (e.g. 'web worker release')"
+        required: true
+        type: string
+    secrets:
+      heroku-key:
+        description: "Heroku API key (OAuth token)"
+        required: true
+      build-args:
+        description: "Docker build args (newline-separated KEY=VALUE pairs, typically for private dependency auth)"
+        required: false
+
+jobs:
+  deploy:
+    if: |
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_branch == inputs.branch) ||
+      (github.event_name == 'workflow_dispatch' && github.ref_name == inputs.branch)
+    concurrency: ${{ inputs.heroku-app || github.event.repository.name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Create deployment in GitHub
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          deploymentId=$(jq -n "{
+              \"ref\": \"${{ inputs.branch }}\",\
+              \"auto_merge\": false,\
+              \"environment\": \"${{ inputs.heroku-app }}\",\
+              \"description\": \"Heroku container deploy from GitHub Actions\",\
+              \"required_contexts\": []\
+            }" \
+            | gh api repos/${{ github.repository }}/deployments \
+              --method POST \
+              --header "Accept: application/vnd.github.v3+json" \
+              --input - \
+              --jq '.id')
+          echo 'DEPLOYMENT_ID='$deploymentId >> $GITHUB_ENV
+
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch }}
+
+      - name: Log in to Heroku Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: registry.heroku.com
+          username: _
+          password: ${{ secrets.heroku-key }}
+
+      - uses: docker/setup-buildx-action@v4
+
+      - name: Build and push per target
+        env:
+          APP: ${{ inputs.heroku-app || github.event.repository.name }}
+          TARGETS: ${{ inputs.targets }}
+          BUILD_ARGS: ${{ secrets.build-args }}
+        run: |
+          build_arg_flags=""
+          while IFS= read -r line; do
+            [ -n "$line" ] && build_arg_flags="$build_arg_flags --build-arg $line"
+          done <<< "$BUILD_ARGS"
+
+          for vfile in .*-version; do
+            [ -f "$vfile" ] || continue
+            name="${vfile#.}"
+            name="${name%-version}"
+            arg_name="$(echo "$name" | tr '[:lower:]-' '[:upper:]_')_VERSION"
+            build_arg_flags="$build_arg_flags --build-arg $arg_name=$(tr -d '[:space:]' < "$vfile")"
+          done
+
+          for target in $TARGETS; do
+            docker buildx build \
+              --target "$target" \
+              --tag "registry.heroku.com/$APP/$target" \
+              --cache-from type=gha \
+              --cache-to type=gha,mode=max \
+              --provenance=false \
+              --push \
+              $build_arg_flags \
+              .
+          done
+
+      - name: Install Heroku CLI
+        run: curl https://cli-assets.heroku.com/install.sh | sh
+
+      - name: Release
+        env:
+          HEROKU_API_KEY: ${{ secrets.heroku-key }}
+          APP: ${{ inputs.heroku-app || github.event.repository.name }}
+          TARGETS: ${{ inputs.targets }}
+        run: heroku container:release $TARGETS -a $APP
+
+      - name: Create deployment status in GitHub
+        if: always()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/deployments/$DEPLOYMENT_ID/statuses \
+            --method POST \
+            --header "Accept: application/vnd.github.v3+json" \
+            --field state=${{ job.status }} \
+            --field log_url=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }} \
+            --field environment_url=https://${{ inputs.heroku-app || github.event.repository.name }}.herokuapp.com/

bin/heroku-container-deploy

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Deploy Docker images to Heroku's container registry.
+# Standalone fallback for when GitHub Actions is unavailable.
+#
+# Usage:
+#   bin/heroku-container-deploy <app> <targets...>
+#   bin/heroku-container-deploy my-app web worker release
+#
+# Build args (for private dependencies) are passed via environment:
+#   BUNDLE_GITHUB__COM=x-access-token:ghp_xxx bin/heroku-container-deploy my-app web worker
+#
+# Requires: docker, heroku CLI, HEROKU_API_KEY env var
+
+if [ $# -lt 2 ]; then
+	echo "Usage: $0 <app> <targets...>" >&2
+	echo "Example: $0 my-app web worker release" >&2
+	exit 1
+fi
+
+APP="$1"
+shift
+TARGETS=("$@")
+
+: "${HEROKU_API_KEY:?Set HEROKU_API_KEY}"
+
+echo "Logging in to Heroku container registry..."
+echo "$HEROKU_API_KEY" | docker login -u _ --password-stdin registry.heroku.com
+
+build_arg_flags=()
+for var in BUNDLE_GITHUB__COM BUNDLE_RUBYGEMS__PKG__GITHUB__COM NPM_TOKEN RUBY_VERSION; do
+	if [ -n "${!var:-}" ]; then
+		build_arg_flags+=(--build-arg "$var=${!var}")
+	fi
+done
+
+for target in "${TARGETS[@]}"; do
+	echo "Building and pushing target: $target"
+	docker build \
+		--target "$target" \
+		--tag "registry.heroku.com/$APP/$target" \
+		--provenance=false \
+		"${build_arg_flags[@]}" \
+		.
+	docker push "registry.heroku.com/$APP/$target"
+done
+
+echo "Releasing: ${TARGETS[*]}"
+heroku container:release "${TARGETS[@]}" -a "$APP"
+
+echo "Done. https://$APP.herokuapp.com/"