Document DevSH Rocket fork workflow

Author: AnastaZIuk

.github/workflows/devsh-foss-image.yml

@@ -50,6 +50,15 @@ jobs:
           echo "IMAGE_TAG=${image_tag}" >> "${GITHUB_ENV}"
           echo "Publishing ${IMAGE}:${image_tag}"
 
+      - name: Validate image tag
+        run: |
+          set -euo pipefail
+          case "${IMAGE_TAG}" in
+            devsh-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]-*) ;;
+            8.*-devsh.*) ;;
+            *) echo "Invalid image tag for DevSH rollout: ${IMAGE_TAG}" >&2; exit 1 ;;
+          esac
+
       - name: Resolve source cache key
         id: source
         run: |

DEVSH.md

@@ -0,0 +1,48 @@
+# DevSH Rocket.Chat Fork
+
+This fork carries the DevSH operational branch for the self-hosted Rocket.Chat deployment.
+
+## Branch Model
+
+- `devsh` is the production build branch used by DevSH infrastructure.
+- `devsh` starts from an upstream Rocket.Chat release tag.
+- Upstream updates should be pulled into `devsh` intentionally, then validated through the image workflow before TerraInfra rolls forward.
+- Runtime production changes belong in TerraInfra. This fork should stay close to upstream Rocket.Chat source.
+
+## FOSS Image Build
+
+The `DevSH FOSS image` workflow builds a fully self-hosted FOSS Rocket.Chat image:
+
+1. Check out the `devsh` branch.
+2. Install Node, Yarn, Deno, and Meteor.
+3. Build shared packages.
+4. Run `yarn fossify`, which removes Enterprise and commercial source directories.
+5. Build the Meteor production bundle.
+6. Build and verify the Docker image.
+7. Publish immutable tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`.
+
+The workflow verifies that the runtime bundle does not contain `AirGappedRestriction`, which is the Enterprise air-gapped restriction path that can make isolated official images read-only.
+
+## Image Tags
+
+Pushes to `devsh` publish:
+
+- `devsh-YYYYMMDDHHMMSS-<sha>` as the immutable rollout tag.
+- `devsh` as a moving convenience tag.
+
+Terraform/Flux uses only immutable `devsh-YYYYMMDDHHMMSS-<sha>` tags for production rollouts.
+
+## TerraInfra Integration
+
+TerraInfra watches the GHCR package with Flux image automation:
+
+- `ImageRepository`: `ghcr.io/devsh-graphics-programming/rocketchat-foss`
+- `ImagePolicy`: newest immutable `devsh-YYYYMMDDHHMMSS-<sha>` tag
+- `ImageUpdateAutomation`: commits the selected tag to `env/prod`
+
+After Flux commits the tag update, the Rocket.Chat HelmRelease rolls the deployment on `prod-rocket-01`.
+
+## Operational Rule
+
+Do not use Rocket.Chat official Enterprise-flavored container images for the isolated DevSH deployment. The DevSH production service uses this FOSS image route so the workspace stays self-hosted without a cloud/license dependency for basic chat functionality.
+

README.md

@@ -1,3 +1,8 @@
+> [!IMPORTANT]
+> This is the DevSH operational fork of Rocket.Chat. The `devsh` branch is used to build a FOSS-only image for the isolated DevSH production workspace. The image workflow runs `yarn fossify`, publishes immutable `devsh-YYYYMMDDHHMMSS-<sha>` tags to `ghcr.io/devsh-graphics-programming/rocketchat-foss`, and TerraInfra/Flux consumes those tags for production rollout on `prod-rocket-01`.
+>
+> Keep runtime infrastructure changes in TerraInfra. Keep this fork close to upstream Rocket.Chat and use `DEVSH.md` for the DevSH branch/build model.
+
 <p align="center"> 
   <img  src="https://github.com/RocketChat/Rocket.Chat.Artwork/raw/master/Logos/2020/png/logo-horizontal-red.png" data-canonical-src="https://github.com/RocketChat/Rocket.Chat.Artwork/raw/master/Logos/2020/png/logo-horizontal-red.png" width="400" />
 </p>