ci: Add workflow to mirror fixture container images to ghcr.io

The digest stability tests in PR #255 reference pinned container images
from upstream registries (registry.access.redhat.com, quay.io).

This job makes it easy for us to mirror fixture images to our own
namespace, just to double check they don't get GC'd.

Ref: #255 (comment)

Assisted-by: OpenCode (Claude Opus 4)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

.github/workflows/mirror-fixture-images.yml

@@ -0,0 +1,39 @@
+name: Mirror CI fixture images
+
+# Copies pinned container images listed in ci/fixture-images.txt to
+# ghcr.io/composefs/ci-fixture-* so CI tests don't depend on upstream
+# registries keeping old builds around forever.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ci/fixture-images.txt
+      - .github/workflows/mirror-fixture-images.yml
+  workflow_dispatch: {}  # allow manual trigger
+
+permissions:
+  packages: write
+
+jobs:
+  mirror:
+    name: Mirror images to ghcr.io
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Log in to ghcr.io
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | skopeo login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Copy images
+        run: |
+          set -euo pipefail
+          copied=0
+          while read -r src dst rest; do
+            echo "::group::Copying $src -> $dst"
+            skopeo copy --all "$src" "$dst"
+            echo "::endgroup::"
+            copied=$((copied + 1))
+          done < <(grep -v '^\s*#' ci/fixture-images.txt | grep -v '^\s*$')
+          echo "Mirrored $copied image(s)."

ci/fixture-images.txt

@@ -0,0 +1,18 @@
+# Container images mirrored to ghcr.io/composefs for CI fixture use.
+#
+# These images are pinned by digest or immutable tag and used in tests
+# (e.g. EROFS digest stability tests).  Mirroring them under our own
+# namespace ensures they remain available even if the upstream registry
+# garbage-collects old builds.
+#
+# Format: <source> <destination>
+# Lines starting with # and blank lines are ignored.
+# The workflow uses `skopeo copy --all` to preserve multi-arch manifests.
+
+# RHEL UBI 10.1, build 1772441712 (amd64).
+# Used in: crates/integration-tests/src/tests/digest_stability.rs
+docker://registry.access.redhat.com/ubi10/ubi:10.1-1772441712 docker://ghcr.io/composefs/ci-fixture-ubi10:10.1-1772441712
+
+# centos-bootc stream10, pinned by manifest digest.
+# Used in: crates/integration-tests/src/tests/digest_stability.rs
+docker://quay.io/centos-bootc/centos-bootc@sha256:d1913e3d616b9acb7fc2e3331be8baf844048bca2681a23d34e53e75eb18f3d0 docker://ghcr.io/composefs/ci-fixture-centos-bootc:stream10-d1913e3d