ci: Add bootc/ submodule for reverse dependency testing

Follows the general pattern in bootc of ensuring that GHA flows
are delegating heavy lifting to targets easily executable locally
via `just`.

Add bootc/Justfile as a just submodule (invoked via just bootc/<target>)
that handles cloning, patching, building, and testing bootc against the
local containers-image-proxy-rs checkout.

Assisted-by: OpenCode (Sonnet 4)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

bootc/Justfile

@@ -0,0 +1,119 @@
+# Justfile for bootc reverse dependency testing
+# Invoked via: just bootc/<target>
+#
+# This builds and tests bootc against the local containers-image-proxy-rs checkout
+# using bootc's BOOTC_extra_src mechanism.
+# --------------------------------------------------------------------
+
+# Configuration variables (override via environment or command line)
+# Example: IMAGE_PROXY_BOOTC_REF=v1.0.0 just bootc/build
+
+# Path to bootc checkout (will be cloned if it doesn't exist)
+path := env("IMAGE_PROXY_BOOTC_PATH", justfile_directory() + "/../target/bootc")
+# Git ref to checkout for bootc (branch, tag, or PR ref)
+ref := env("IMAGE_PROXY_BOOTC_REF", "main")
+# Remote repository for bootc
+repo := env("IMAGE_PROXY_BOOTC_REPO", "https://github.com/bootc-dev/bootc")
+
+# Internal: absolute path to the containers-image-proxy-rs checkout (parent of this Justfile)
+_proxy_src := justfile_directory() + "/.."
+
+# Clone or update bootc repository
+clone:
+    #!/bin/bash
+    set -euo pipefail
+    if [ -d "{{path}}/.git" ]; then
+        echo "bootc already cloned at {{path}}"
+        echo "To update: cd {{path}} && git fetch && git checkout <ref>"
+    else
+        echo "Cloning bootc from {{repo}} (ref: {{ref}}) to {{path}}"
+        mkdir -p "$(dirname "{{path}}")"
+        # Use --no-checkout with --filter for efficient cloning, then fetch the specific ref
+        # This handles PR refs (refs/pull/123/head) correctly
+        git clone "{{repo}}" "{{path}}" --no-checkout --filter=blob:none
+        cd "{{path}}"
+        git fetch --depth=1 origin "{{ref}}"
+        git checkout FETCH_HEAD
+    fi
+
+# Patch bootc's Cargo.toml to use /run/extra-src paths for containers-image-proxy-rs
+patch: clone
+    #!/bin/bash
+    set -euo pipefail
+    cd "{{path}}"
+
+    # Check if already patched
+    if grep -q 'Patched by containers-image-proxy-rs' Cargo.toml 2>/dev/null; then
+        echo "bootc already patched for containers-image-proxy-rs"
+        exit 0
+    fi
+
+    echo "Patching bootc Cargo.toml to use /run/extra-src for containers-image-proxy-rs"
+
+    # Add [patch] section using /run/extra-src paths (mounted via BOOTC_extra_src)
+    {
+        echo ''
+        echo '# Patched by containers-image-proxy-rs CI to test against local checkout'
+        echo '# The /run/extra-src path is bind-mounted via BOOTC_extra_src'
+        echo '[patch.crates-io]'
+        echo 'containers-image-proxy = { path = "/run/extra-src" }'
+    } >> Cargo.toml
+
+    # Patch the workspace lints to allow missing_docs for containers-image-proxy-rs
+    # bootc has workspace.lints.rust.missing_docs = "deny" but this crate has undocumented items
+    sed -i 's/missing_docs = "deny"/missing_docs = "allow"/' Cargo.toml
+
+    echo "bootc patched successfully"
+
+# Build sealed bootc image using local containers-image-proxy-rs
+build: patch
+    #!/bin/bash
+    set -euo pipefail
+    cd "{{path}}"
+    echo "Building sealed bootc image with BOOTC_extra_src={{_proxy_src}}"
+    BOOTC_extra_src="{{_proxy_src}}" just build-sealed
+
+# Run bootc tests using local containers-image-proxy-rs
+test: build
+    #!/bin/bash
+    set -euo pipefail
+    cd "{{path}}"
+    echo "Running bootc tests..."
+    # Create /run/extra-src symlink so host cargo commands can resolve the patched paths
+    # (BOOTC_extra_src only mounts inside container builds, not for host cargo)
+    sudo ln -sfn "{{_proxy_src}}" /run/extra-src
+    BOOTC_extra_src="{{_proxy_src}}" cargo test --workspace
+
+# Clean the bootc checkout and any patches
+clean:
+    #!/bin/bash
+    set -euo pipefail
+    if [ -d "{{path}}" ]; then
+        echo "Removing bootc checkout at {{path}}"
+        rm -rf "{{path}}"
+    else
+        echo "No bootc checkout found at {{path}}"
+    fi
+
+# Show current bootc integration configuration
+config:
+    #!/bin/bash
+    cat <<EOF
+    Bootc Integration Configuration
+    ================================
+    path:  {{path}}
+    ref:   {{ref}}
+    repo:  {{repo}}
+
+    containers-image-proxy-rs source: {{_proxy_src}}
+
+    Environment Variables:
+      IMAGE_PROXY_BOOTC_PATH - Override bootc checkout path
+      IMAGE_PROXY_BOOTC_REF  - Override bootc git ref (branch/tag/PR)
+      IMAGE_PROXY_BOOTC_REPO - Override bootc git repository
+
+    Example Usage:
+      just bootc/build                                      # Clone main, patch, and build
+      IMAGE_PROXY_BOOTC_REF=v1.2.0 just bootc/build         # Use specific tag
+      IMAGE_PROXY_BOOTC_REF=refs/pull/1791/head just bootc/build  # Use PR
+    EOF