The active job runs `cargo test` in the per-run container; the
Dockerfile installs the toolchain it needs (debian-trixie + rustup +
build-essential + git). The mirror block stays as a commented-out
template for re-enabling once the github_token secret path is ready.

Assisted-by: Claude Opus 4.7 via Claude Code

diff --git a/.quire/Dockerfile b/.quire/Dockerfile
new file mode 100644
index 0000000..224e3b6
--- /dev/null
+++ b/.quire/Dockerfile
@@ -0,0 +1,15 @@
+FROM debian:trixie
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    bc \
+    build-essential \
+    ca-certificates \
+    curl \
+    git \
+    grcov \
+    jq \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --component clippy,llvm-tools-preview,rustfmt
+
+ENV PATH="/root/.cargo/bin:${PATH}"
diff --git a/.quire/ci.fnl b/.quire/ci.fnl
index da6b10c..6cc21e0 100644
--- a/.quire/ci.fnl
+++ b/.quire/ci.fnl
@@ -1,8 +1,35 @@
-(local {: mirror} (require :quire.ci))
+(local {: job : mirror} (require :quire.ci))
 
-(mirror "https://github.com/kejadlen/quire.git"
-        {:refs [:refs/heads/main]
-         :secret :github_token
-         :tag (fn [{: sha}]
-                (.. :v (os.date "!%Y-%m-%d") "-" (sha:sub 1 8)))})
+(local mirror-url "https://github.com/kejadlen/quire.git")
 
+(job :tag-and-mirror [:quire/push]
+     (fn [{: sh : secret : jobs}]
+       (let [{: ref : sha : git-dir} (jobs :quire/push)
+             token (secret :github_token)]
+         (when (= ref :refs/heads/main)
+           (let [date (-> (sh "date --utc +%Y-%m-%d")
+                          (. :stdout)
+                          (: :gsub "\n$" ""))
+                 tag (.. :v date "-" (sha:sub 1 8))
+                 encoded (-> (sh "printf '%s' \"$T\" | base64 --wrap=0"
+                                 {:env {:T (.. "x-access-token:" token)}})
+                             (. :stdout))
+                 auth-header (.. "Authorization: Basic " encoded)
+                 git-opts {:env {:GIT_DIR git-dir}}]
+             (sh [:git :tag tag sha] git-opts)
+             (sh [:git
+                  :-c
+                  (.. :http.extraHeader= auth-header)
+                  :push
+                  :--porcelain
+                  mirror-url
+                  :refs/heads/main
+                  (.. :refs/tags/ tag)] git-opts))))))
+
+; (mirror "https://github.com/kejadlen/quire.git"
+;         {:refs [:refs/heads/main]
+;          :secret :github_token
+;          :tag (fn [{: sha}]
+;                 (.. :v (os.date "!%Y-%m-%d") "-" (sha:sub 1 8)))})
+
+; (job :test [:quire/push] (fn [{: sh}] (sh [:cargo :test])))