First pass at adding apptainer image building

[mikemhenry]

• TODO: Push directly to a container registry instead of upload apptainer image

[mikemhenry]

This is nice and small BUT now the problem is that if the singularity image fails to build, it takes out the docker build as well. I want to make this more modular so I am going to rework it.

[mikemhenry]

The biggest change this PR makes (other than adding sif building) is:

- "ENV OMSF_PIXI_WORKSPACE=/root",
+ "ENV OMSF_PIXI_WORKSPACE=/opt/omsf/workspace",

Pixi with the workspace as /root isn't going to work with singularity since it will overlay the filesystem and won't be writable by a user.

[ethanholz]

This is pretty common for a lot of people, I wonder if it might be worth publishing a composite action in the future. Might make this process easier for others to maintain. No need to add this here, just food for thought.

[mikemhenry]

The reusable piece is probably "take an OCI image, convert it to SIF, and publish it to an OCI registry," while leaving repo-specific tagging/promotion policy outside the action.

And I agree we can do this in a follow up PR/after we need it again.

[ethanholz]

This looks great just a few questions around choices but otherwise, everything looks good!

[ethanholz]

Why use ORAS specifically? More of a curiosity than a need to change anything.

[mikemhenry]

I'll have to double check, I think I had to use it when I set this up for openfe and docker:// didn't accept sif images but oras:// did.

[mikemhenry]

docker:// is for normal OCI container images. Apptainer can pull one and convert it into a SIF, which is what we do during the build. A SIF itself is stored in the registry as an OCI artifact, and Apptainer uses oras:// for pushing and pulling those.

For the promotion step, ORAS also lets us add the latest and dated tags directly to the existing artifact rather than pulling and republishing the SIF.

This is consistent with Apptainer docs