Verify image healthcheck before publishing from Gitea

.gitea/workflows/build.yml

@@ -73,21 +73,18 @@ jobs:
             -t "$FULL_IMAGE:latest" \
             -t "$FULL_IMAGE:v$VERSION" \
             -t "$FULL_IMAGE:sha-$SHORT_SHA" \
-            --push \
+            --load \
             .
 
-      # -------------------------------------------------
-      # Push all tags
-      # -------------------------------------------------
-     # - name: Push all tags
-     #   env:
-     #     REGISTRY: ${{ vars.REGISTRY }}
-     #     IMAGE: david/tvj-epg
-     #     VERSION: ${{ steps.version.outputs.version }}
-     #   run: |
-     #     SHORT_SHA="${GITHUB_SHA::7}"
-     #     FULL_IMAGE="$REGISTRY/david/tvj-epg"
-
-     #     docker push "$FULL_IMAGE:latest"
-     #     docker push "$FULL_IMAGE:v$VERSION"
-     #     docker push "$FULL_IMAGE:sha-$SHORT_SHA"
+      - name: Verify healthcheck and publish
+        env:
+          REGISTRY: ${{ vars.REGISTRY }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          SHORT_SHA="${GITHUB_SHA::7}"
+          FULL_IMAGE="$REGISTRY/david/tvj-epg"
+          docker image inspect "$FULL_IMAGE:latest" | python3 scripts/verify_image_healthcheck.py
+          docker push "$FULL_IMAGE:latest"
+          docker push "$FULL_IMAGE:v$VERSION"
+          docker push "$FULL_IMAGE:sha-$SHORT_SHA"

README.md

@@ -9,7 +9,7 @@ provider plugin; the engine fetches their common feed once per update.
 Build this checkout and select both channels:
 
 ```sh
-podman build -t tvj-epg .
+podman build --format docker -t tvj-epg .
 podman run -d --name tvj-epg -p 1876:1876 \
   -e TZ=America/Jamaica \
   -e CHANNELS=tvj,tvjsn \
@@ -125,3 +125,15 @@ not configure automatic restart behavior.
 curl http://localhost:1876/health
 podman inspect --format '{{.State.Health.Status}}' tvj-epg
 ```
+
+### Automatic healthcheck inheritance
+
+No health environment variable or Quadlet `HealthCmd` is required. New containers
+inherit the image healthcheck unless deployment settings explicitly disable it.
+Build with `podman build --format docker` to preserve healthcheck metadata; OCI
+builds can omit it. The Gitea publishing workflow verifies the image healthcheck before pushing
+tags. It loads and verifies the image before publishing.
+
+After an image update, pull the new image and recreate the container through its
+Quadlet service to acquire the metadata. An existing container does not acquire
+new image settings simply because a tag was updated in the registry.

scripts/verify_image_healthcheck.py

@@ -0,0 +1,10 @@
+"""Fail publication if the built image lost its automatic healthcheck."""
+import json
+import sys
+
+images = json.load(sys.stdin)
+healthcheck = images[0].get("Config", {}).get("Healthcheck") or {}
+expected = ["CMD", "python", "-m", "epg.healthcheck"]
+if healthcheck.get("Test") != expected:
+    sys.exit("Image healthcheck missing or incorrect; refusing publication")
+print("Image healthcheck verified")