ci: GitHub Actions to build/test and publish Docker images to GHCR

Two workflows mirroring coinshift-rs's CI, adapted to simplepool:

- check_build.yaml: compile the C11 stratum proxy and run 'make test'
  (installs the same -dev deps as the Docker build stage).
- build_docker.yaml: build the three service images (simplepool,
  simplepool-dashboard, simplepool-payout) via a matrix and push them to
  ghcr.io/<owner>/<image> using the built-in GITHUB_TOKEN. PRs build-only.

Both jobs are guarded with 'if: github.repository_owner == LayerTwo-Labs' so
they run only in the canonical org repo (publishing to ghcr.io/layertwo-labs/*)
and stay inert on a personal fork.

Author: rsantacroce

.github/workflows/build_docker.yaml

@@ -0,0 +1,87 @@
+# Build the three simplepool container images and push them to the GitHub
+# Container Registry (ghcr.io) — the same registry coinshift-rs publishes to.
+#
+# This job runs only in the canonical LayerTwo-Labs repo (see the `if:` guard
+# on the job), so images land in the org namespace, tagged automatically:
+#   ghcr.io/layertwo-labs/simplepool            (C stratum proxy)
+#   ghcr.io/layertwo-labs/simplepool-dashboard  (Node read-only web UI)
+#   ghcr.io/layertwo-labs/simplepool-payout     (Node Thunder payout worker)
+#
+# Auth uses the built-in GITHUB_TOKEN — no secrets to configure, because the
+# repo lives in the same org that owns the packages (exactly like coinshift).
+# Pull-request runs build the images (to prove the Dockerfiles still work) but
+# do not push; only pushes to main, tags, and manual runs publish.
+name: Build and push Docker images
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+  workflow_dispatch:
+  pull_request:
+
+jobs:
+  build-push-docker:
+    runs-on: ubuntu-latest
+    # Publish only from the LayerTwo-Labs org repo. On a personal fork/repo
+    # (e.g. rsantacroce/simplepool) this is false, so the whole job is skipped
+    # — nothing is built and nothing is pushed. (String compare is
+    # case-insensitive, so 'LayerTwo-Labs' also matches 'layertwo-labs'.)
+    if: github.repository_owner == 'LayerTwo-Labs'
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: simplepool
+            dockerfile: deploy/docker/Dockerfile.simplepool
+          - image: simplepool-dashboard
+            dockerfile: deploy/docker/Dockerfile.dashboard
+          - image: simplepool-payout
+            dockerfile: deploy/docker/Dockerfile.payout
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/${{ github.repository_owner }}/${{ matrix.image }}
+          tags: |
+            type=sha,event=push
+            type=ref,event=pr
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        # Skipped on pull_request, where we build-only and don't push.
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          # Per-image GitHub Actions cache so the three legs don't collide.
+          cache-from: type=gha,scope=${{ matrix.image }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image }}

.github/workflows/check_build.yaml

@@ -0,0 +1,37 @@
+# Compile simplepool and run its unit tests on every push/PR.
+# simplepool is pure C11 (see Makefile); its deps are the same -dev packages
+# the build stage of deploy/docker/Dockerfile.simplepool installs.
+name: Build and test
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    # Match build_docker.yaml: CI runs only in the LayerTwo-Labs org repo, so
+    # pushing to a personal repo doesn't spend Actions minutes. Remove this line
+    # if you *do* want build/test CI to run on your own fork too.
+    if: github.repository_owner == 'LayerTwo-Labs'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            build-essential \
+            libsqlite3-dev \
+            libcurl4-openssl-dev \
+            libhiredis-dev
+
+      - name: Build
+        run: make -j"$(nproc)"
+
+      - name: Test
+        run: make test