Summary

Tier 3 follow-up to the post-#266 hardening. Adds a PR-time publish-manifest-rehearsal job to construct.yml that runs the same docker buildx CLI plumbing publish-manifest depends on, without the side-effect steps (Docker Hub login, imagetools create, imagetools inspect). The rehearsal closes the gap that let #266 reach main: workflow-level env vars consumed by third-party CLIs (in #266's case BUILDX_BUILDER) were never exercised on PR because every job that calls docker buildx is gated to push-to-main.

How the rehearsal catches the #266 class of break

docker buildx ls evaluates BUILDX_BUILDER (and any other buildx-controlling env var) at startup and exits non-zero on a missing-builder reference. That's the exact failure shape publish-manifest emitted post-#256-merge:

ERROR: no builder "jackin-construct" found
error: Recipe `construct-publish-manifest` failed with exit code 1

Running the same call without registry credentials surfaces the same error before any network write. A second cheap step — docker buildx imagetools --help >/dev/null — confirms the buildx CLI plugin is bundled and loadable on the runner.

The rehearsal runs on the events publish-manifest itself skips: PR and feature-branch workflow_dispatch that touch construct paths. The construct-required aggregator now lists publish-manifest-rehearsal in needs: so its result is rolled up into the same single required-check name branch protection enforces.

What's deferred

Similar rehearsals for build-validator (CI), deploy (Docs), and publish-preview (Homebrew preview) are not included. None of those side-effect surfaces — release artifacts in GitHub-side storage, GitHub Pages publish, Homebrew tap PR-create — has the same network-free reproducibility shape buildx ls provides for docker. Adding rehearsals for them would either require synthesizing fake side effects (high false-confidence risk) or re-architecting the workflow trigger (preview.yml fires on workflow_run from CI completion on main, not PR). Reopen if a #266-class break surfaces in any of them.

Verify locally

Checkout

export TIRITH=0

mkdir -p "$HOME/Projects/jackin-project/test"
cd "$HOME/Projects/jackin-project/test"

if [ ! -d jackin/.git ]; then
  git clone https://github.com/jackin-project/jackin.git
fi

cd jackin
mise trust
git fetch -f origin ci/construct-publish-manifest-rehearsal:refs/remotes/origin/ci/construct-publish-manifest-rehearsal
git checkout -B ci/construct-publish-manifest-rehearsal refs/remotes/origin/ci/construct-publish-manifest-rehearsal

Static checks

yq . .github/workflows/construct.yml >/dev/null

Smoke (CI runner only — local docker may not bundle buildx)

docker buildx ls
docker buildx imagetools --help >/dev/null && echo ok

The CI run on this PR is the actual fidelity test — publish-manifest-rehearsal should run, report green, and be visible in the construct-required rollup. Push to main on merge will skip the rehearsal (because is_publish == 'true') and run the real publish-manifest, exactly as before this PR.