[DharmaBytesX]

Summary

A user who wants to try the demo builds the Streamlit Service Catalog image locally
(Slack thread).
This PR publishes it as an image on registry.opsmill.io, so invoke start pulls it.

It is the same change as opsmill/infrahub-demo-sp#152,
which is merged and published its images from main
(run).
This PR applies it to infrahub-demo-dc, with one image instead of two. The Styrmin
generic-app driver takes an image repository and tag
(styrmin#468), so the sandbox can use the image.

Image, workflow and local development changes

• Image: registry.opsmill.io/opsmill/infrahub-demo-dc-streamlit, for linux/amd64 and
  linux/arm64, tagged main and sha-<commit>.
• Workflow publish-images.yml:
  • Pull requests build the amd64 image and smoke-test it without secrets: the application
    files are present, the user is not root, and the container reports healthy.
  • Pushes to main that touch the image sources, a weekly run (Monday 04:41 UTC) and manual
    runs with publish push the image, sign it with Cosign and attach SPDX and CycloneDX
    software bills of materials. The steps are those of the demo-sp workflow.
• Self-contained image:
  • It carries objects/dc/ (the DC templates the Create DC page lists) and the logos from
    docs/static/img/, which compose used to mount.
  • It runs as a non-root user.
  • It installs the versions pinned in uv.lock. streamlit and pandas were not in the lock,
    so they move into a new catalog dependency group in pyproject.toml. Dependabot now
    manages them. service_catalog/requirements.txt lists package names only.
• Lock update: anyio 4.11.0 to 4.15.1 and typing-extensions 4.15.0 to 4.16.0.
  Harbor's scan of a test push of this image flagged anyio 4.11.0 as Critical
  (CVE-2026-63374, fixed in 4.14.2). After the update the scan shows 0 Critical and 65 High.
  Both packages are also used by the repository's own tooling.
• Compose and invoke:
  • The compose override names the image (STREAMLIT_IMAGE, default ...:main), and
    invoke start pulls it.
  • invoke start --rebuild or INFRAHUB_SERVICE_CATALOG_BUILD=true builds from the checkout,
    using the new docker-compose.catalog-dev.yml, which also mounts the sources.
  • The README no longer shows docker-compose --profile service-catalog up, which needs a
    local base compose file this repository does not have.
• Port: the image listens on 8501. STREAMLIT_SERVER_PORT changes it, which the generic-app
  driver needs (it requires 8080, per styrmin#468).
• Docs: README, install and service catalog pages.

Before merge

• The repository needs the secrets HARBOR_USERNAME and HARBOR_PASSWORD and the variable
  HARBOR_HOST. At the time of writing, none of them is set here.
• The merge publishes the first image. Until that run finishes, starting with the catalog
  enabled cannot pull :main.
• The Harbor tag retention rules visible on 16 October cover infrahub, infrahub-enterprise
  and styrmin. No rule covers this image yet.

Test plan

Verified on a local arm64 machine:

• The image builds and runs. The versions inside match uv.lock, the user is uid 1000, the
  templates and logos are present, and STREAMLIT_SERVER_PORT=8080 is honoured.
• invoke lint and invoke test-unit pass, including 4 new tests. actionlint passes on the
  workflow. The compose config resolves correctly in both modes.
• The build, push, digest hand-off and manifest merge steps ran with act against Harbor.
  Both architectures were pushed and pulled back. Signing, the software bills of materials and
  the GitHub cache were not part of that run, and the health check ran inside the container.
• A clean stack was started with the documented invoke start and invoke bootstrap, with
  the catalog pulled from Harbor. Creating dc-arista from the Create DC page made a branch,
  ran the generator and opened a proposed change. All 32 validators succeeded. The other
  catalog pages load.

Not verified:

• Signing and the software bills of materials for this image. The same steps ran on GitHub in
  the demo-sp workflow linked above.
• The first run of this workflow on GitHub, and whether the Harbor account in the repository
  secrets can push images and signatures.
• amd64 was only started under emulation.

---

Assisted-by: opsmill-dev-commit 0.1.0
Assisted-by: opsmill-dev-pr 0.2.0

[cloudflare-workers-and-pages]

Deploying infrahub-demo with    Cloudflare Pages

Latest commit:	26b1f06
Status:	✅  Deploy successful!
Preview URL:	https://b090e193.infrahub-demo.pages.dev
Branch Preview URL:	https://ci-publish-streamlit-image.infrahub-demo.pages.dev

View logs

[lancamat1]

lgtm, but the repo does not have HARBOR_HOST, HARBOR_USERNAME and HARBOR_PASSWORD set yet, so the publish run will fail on merge. please add them first, same as on service-catalog