[VargaJoe]

Summary

• add a repository-owned GitHub Actions workflow for sensenetcsp/sn-identityserver
• preserve the TFS-compatible date tags and the preview/latest moving tags, while adding source-branch and immutable SHA tags
• keep pull requests build-only and support optional manual publication from the branch selected in GitHub
• use Node 24-based current major versions of the checkout and Docker actions

TFS compatibility audit

TFS definition 348 downloads only Sn-Deployment/scripts/**. Its active IdentityServer build resolves to a plain Docker build using this repository's src/SenseNet.IdentityServer4.Web/Dockerfile and src context. The private-feed preparation task is disabled; no build arguments, generated assets, or IdentityServer-specific preparation need to be reproduced.

The deleted hotfix/node-version-in-dockerfile remote branch contained the same Node 14 version and checksum already present on develop, so it was not merged. A full current build proved that the Node and Yarn download/install layers still work.

TFS definition 348 remains enabled. It should be disabled only after a successful merge-time GitHub publication and Docker Hub tag verification.

Validation

• full pushless build: docker buildx build --progress=plain --output type=cacheonly --file ./src/SenseNet.IdentityServer4.Web/Dockerfile ./src
• Node/Yarn frontend build, .NET restore/build/publish, and final image stage completed successfully
• all referenced action majors declare node24
• git diff --cached --check
• workflow contract assertions