ci: verify brew nspawn image weekly

.github/workflows/brew-nspawn.yml

@@ -0,0 +1,43 @@
+name: Verify brew nspawn image
+
+# The brew image is a deliberate non-distroless machine-image lane. It is
+# expensive and unrelated to OCI image publication, so verify it weekly and
+# on demand rather than on every pull request.
+on:
+  schedule:
+    - cron: "30 4 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: brew-nspawn-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify-brew:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: taiki-e/install-action@16b05812d776ae1dfaabc8277e421fb6d2506419 # v2
+        with:
+          tool: just
+
+      - name: Verify brew nspawn machine image
+        run: just verify-brew
+
+      - name: Summarize exported artifacts
+        if: always()
+        run: |
+          if [ -d dist ]; then
+            {
+              echo '## brew nspawn artifacts'
+              echo
+              echo '```text'
+              ls -lh dist
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi

docs/skills/README.md

@@ -28,6 +28,7 @@ load the focused skill for your task.
 | Run local/agent builds on the ghost cluster (remote execution) | [remote-execution.md](remote-execution.md) |
 | Set up custom builds and configure GHA/BuildStream caching | [custom-builds-and-caching.md](custom-builds-and-caching.md) |
 | Automate ArtifactHub submissions | [artifacthub-automation.md](artifacthub-automation.md) |
+| Verify the brew nspawn machine image | [nspawn-machine-image.md](nspawn-machine-image.md) |
 | Container quality standards and SRE tagging | [container-standards.md](container-standards.md) |
 | Run or respond to a security audit / review | [security-review.md](security-review.md) |
 | Finishing a task (always) | [skill-improvement.md](skill-improvement.md) |

docs/skills/ci-tooling.md

@@ -148,8 +148,9 @@ reusable workflow](https://docs.github.com/en/actions/how-tos/reuse-automations/
 and [Control concurrency of workflows and
 jobs](https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/control-workflow-concurrency).
 
-`brew-nspawn` (machine tarball) is not currently wired into any CI workflow
-— see docs/skills/nspawn-machine-image.md. `podman-vm` (bootable VM disk) is
+`brew-nspawn` (machine tarball) is verified weekly and on demand by
+`.github/workflows/brew-nspawn.yml`; it runs `just verify-brew` without
+requiring a systemd host. `podman-vm` (bootable VM disk) is
 deliberately excluded from the OCI publishing matrix — see
 docs/skills/vm-podman-guest.md for the VM guest's own build/test/publish
 pipeline.

docs/skills/nspawn-machine-image.md

@@ -84,6 +84,7 @@ Get the artifact out with `bst artifact checkout <oci elem> --directory dist`.
 ## Verification
 
 `just verify-brew` exports the tarball and asserts the real `usr/bin/*` paths,
-the init symlink, locale.conf, machine-id, and the app user at uid 1001. Booting
-(`machinectl import-tar` + `machinectl start`) requires a systemd host and is not
-done in CI here — note it as an integration step.
+the init symlink, locale.conf, machine-id, and the app user at uid 1001. The
+scheduled/on-demand `.github/workflows/brew-nspawn.yml` job runs this check on a
+native Ubuntu runner. Booting (`machinectl import-tar` + `machinectl start`)
+requires a systemd host and remains a separate integration step.