Add custom Kingfisher container built from sporked feature branches

- Dockerfile: deterministic build from pinned CONTAINER_APP_VERSION + FEATURES
- Merges named feature branches at specific SHAs for reproducibility
- Switch CronJob to custom image with --clone-url-base and --all-organizations
- Add kingfisher to service-versions.yaml (version tracks upstream main SHA)
- Document spork container builds in new how-to card
- Document spork workflow in CLAUDE.md
- Update kingfisher service docs for custom image

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/changelog.d/feature-kingfisher-container.feature.md

@@ -0,0 +1 @@
+Build custom Kingfisher container from sporked deploy branch, replacing upstream image with locally-built version including --clone-url-base patch.

docs/explanation/spork-strategy.md

@@ -60,6 +60,7 @@ Note that a cron-triggered workflow is especially dangerous: it requires no user
 
 - [[create-a-spork]] — initial setup with `mise run spork-create`
 - [[manage-spork-branches]] — feature branches, the deploy branch, handling rebase conflicts
+- [[build-spork-container]] — building reproducible containers from pinned SHAs
 
 ## See also
 

docs/how-to/configuration/build-spork-container.md

@@ -0,0 +1,86 @@
+---
+title: Build a Spork Container
+modified: 2026-03-29
+last-reviewed: 2026-03-29
+tags:
+  - how-to
+  - containers
+  - git
+---
+
+# Build a Spork Container
+
+How to build a container image from a [[spork-strategy|sporked]] project with fully-pinned, reproducible inputs.
+
+## Why not use the `deploy` branch directly?
+
+The `deploy` branch is force-pushed on every mirror-sync. Building from `deploy` is not reproducible — the same Dockerfile run a week later gives different code. Instead, spork containers build their own merge tree from explicit inputs:
+
+- **`CONTAINER_APP_VERSION`** — the commit on `main` to base on (the upstream version)
+- **`FEATURES`** — space-separated `branch=sha` pairs to merge on top
+
+This makes builds reproducible regardless of when they run.
+
+## Prerequisites
+
+- Sporked project set up (see [[create-a-spork]])
+- Container build tooling (`mise run container-build-and-release`)
+
+## Get the SHAs
+
+```fish
+cd ~/code/3rd/kingfisher
+git fetch origin
+
+# Upstream SHA (what main is based on)
+git rev-parse --short origin/main
+# e.g., 1d37d29
+
+# Feature branch SHAs
+git rev-parse --short origin/feature/upstream/clone-url-base
+# e.g., 677c7a5
+```
+
+## Build the container
+
+```fish
+# The version in service-versions.yaml is the upstream SHA
+mise run container-build-and-release kingfisher 1d37d29 \
+    --build-arg CONTAINER_APP_VERSION=1d37d29 \
+    --build-arg FEATURES="feature/upstream/clone-url-base=677c7a5"
+```
+
+The container tag will be `1d37d29-<blumeops-commit>`.
+
+## Update the deployment
+
+1. Update `argocd/manifests/kingfisher/kustomization.yaml` with the new tag
+2. Update `service-versions.yaml` if the upstream SHA changed
+3. Sync the ArgoCD app
+
+## How the Dockerfile works
+
+The build stage:
+
+1. Clones the sporked repo from forge
+2. Checks out `main` at `CONTAINER_APP_VERSION`
+3. For each entry in `FEATURES`, fetches the branch and merges at the pinned SHA
+4. Builds from source with `cargo build --release`
+
+If any merge conflicts, the build fails loudly.
+
+The runtime stage is minimal: debian-slim + git + the binary.
+
+## Note on `CONTAINER_APP_VERSION`
+
+For most blumeops containers, `CONTAINER_APP_VERSION` is an upstream release version like `5.22.0` or `v2.19.2`. For sporked containers it's a git SHA — the upstream commit the build is based on. This is a deliberate abuse of the naming convention to satisfy the `container-version-check` hook. Don't confuse it with an upstream release number.
+
+## Reproducibility guarantee
+
+Given the same `CONTAINER_APP_VERSION` and `FEATURES`, the build produces identical source code regardless of what `deploy`, `blumeops`, or `main` currently look like on forge. The only external dependency is the Rust/Boost toolchain version in the `FROM` line.
+
+## See also
+
+- [[create-a-spork]] — initial spork setup
+- [[manage-spork-branches]] — feature branch workflow
+- [[kingfisher]] — first sporked project

docs/reference/services/kingfisher.md

@@ -16,7 +16,7 @@ Secret detection and live validation scanner for Forgejo repositories, using Mon
 | Property | Value |
 |----------|-------|
 | **Namespace** | `kingfisher` |
-| **Image** | `ghcr.io/mongodb/kingfisher` (see `argocd/manifests/kingfisher/kustomization.yaml` for current tag) |
+| **Image** | `registry.ops.eblu.me/blumeops/kingfisher` (see `argocd/manifests/kingfisher/kustomization.yaml` for current tag) |
 | **Schedule** | Sunday 4am (after Prowler k8s scan at 3am) |
 | **Reports** | `sifaka:/volume1/reports/kingfisher/` (NFS) |
 | **Manifests** | `argocd/manifests/kingfisher/` |
@@ -24,7 +24,7 @@ Secret detection and live validation scanner for Forgejo repositories, using Mon
 
 ## What it does
 
-Runs as a weekly CronJob that scans all repositories in the `eblume` user on Forgejo for leaked secrets, API keys, and credentials. Produces timestamped HTML and JSON reports on the sifaka NFS share.
+Runs as a weekly CronJob that scans all Forgejo repos (eblume + all orgs) for leaked secrets, API keys, and credentials. Produces timestamped HTML reports on the sifaka NFS share. Uses `--clone-url-base` to route git clones via the internal tailnet instead of the public Fly.io proxy.
 
 Uses the Forgejo/Gitea API to enumerate repos, then clones and scans each one. Validation is enabled (secrets are tested against their respective APIs to confirm they're live). Reports are HTML only.
 
@@ -46,7 +46,7 @@ kubectl logs -f job/kingfisher-manual -n kingfisher --context=minikube-indri
 
 ## Limitations
 
-- Clone URLs come from Forgejo's API response using the instance's public `ROOT_URL` (`forge.eblu.me`), so clones roundtrip through Fly.io. Mirror/org scanning is excluded for now to avoid unnecessary external bandwidth. A clone URL rewrite option would need an upstream contribution.
+- Built from a [[spork-strategy|sporked]] fork with a local `--clone-url-base` patch. See [[build-spork-container]] for the build process.
 - Only one output format per invocation. Currently producing HTML only.
 
 ## See also