[ivangrynenko]

Resolves #1

Summary

Add a copyable workflow for private Drupal database images, with SSH, Platform.sh, Upsun and Quant Cloud export paths. Hosting API tokens and SSH credentials come from GitHub Actions secrets; Quant creates and downloads the exact new backup. The GHCR package must already be private and is scoped to the application repository.

Include a baseline Drupal sanitiser and a verifier that restores the output to a separate isolated database. Site-specific sanitisation and verification hooks deliberately fail until implemented and reviewed. Database and hook output are suppressed to avoid exposing SQL data in workflow logs. The original export stays out of the image build context.

The example documents hosting settings, secrets, registry and consumer setup, and the limits of the baseline. It includes an exact-ID Quant Cloud CLI download helper for already-authenticated local use; GitHub automation uses the provider action with a secret API key. Exporters refuse existing destinations and use restrictive file permissions. The repository test workflow and example use major version tags for checkout.

Validation

• ShellCheck and actionlint passed; 53 existing Bats tests and 7 focused database-image tests passed, including isolated MariaDB tests with synthetic data and mocked provider exports.
• Independent security review verified fixes for sensitive SQL leaking into logs and permissive existing export destinations.
• No live hosting credentials or private registry were used. Provider connectivity, site-specific sanitisation and data handling must be tested and reviewed by each adopting project.