feat(vagrant): the Vagrant box catalog's web page, and vagrant.almalinux.org as its address

.github/workflows/vagrant-build-test-publish.yml

@@ -4,9 +4,9 @@ run-name: >-
 
 # Unified Vagrant pipeline: build the boxes with Packer, run the `vagrant up`
 # smoke test, upload them to S3, and publish them in the AlmaLinux Vagrant box
-# catalog on S3 (https://<AWS_S3_BUCKET>.s3.us-east-1.amazonaws.com/vagrant/,
-# which replaces the HCP Vagrant Registry: it stopped accepting new box
-# versions on 2026-10-01 and shuts down on 2026-12-31).
+# catalog on S3, served at https://vagrant.almalinux.org (which replaces the
+# HCP Vagrant Registry: it stopped accepting new box versions on 2026-10-01
+# and shuts down on 2026-12-31).
 #
 # Build + test + S3 upload come from shared-steps (run_test gates the live
 # test). Each build leg whose box passed its test - the `vagrant up` test, or
@@ -139,9 +139,10 @@ on:
 env:
   PACKER_GITHUB_API_TOKEN: ${{ secrets.GIT_HUB_TOKEN }}
   # The Vagrant box catalog: s3://<AWS_S3_BUCKET>/<VAGRANT_CATALOG_PREFIX>/<org>/<box>[.json],
-  # served at https://<AWS_S3_BUCKET>.s3.us-east-1.amazonaws.com/<prefix>/ (the
-  # address users set as VAGRANT_SERVER_URL); the box URLs in it point at
+  # served at VAGRANT_SERVER_URL (CloudFront in front of the bucket's
+  # <prefix>/ folder: the address users set); the box URLs in it point at
   # VAGRANT_BOX_BASE_URL/<S3 key>
+  VAGRANT_SERVER_URL: https://vagrant.almalinux.org
   VAGRANT_CATALOG_PREFIX: vagrant
   VAGRANT_CATALOG_ORG: almalinux
   VAGRANT_BOX_BASE_URL: https://${{ vars.AWS_S3_BUCKET }}.s3.amazonaws.com
@@ -563,6 +564,8 @@ jobs:
         id: entries
         run: |
           # List the recorded boxes
+          # The catalog is read and checked on the bucket itself, not through
+          # VAGRANT_SERVER_URL, whose CDN may serve a file up to its max-age old
           echo "CATALOG_URL=https://${BUCKET}.s3.us-east-1.amazonaws.com/${VAGRANT_CATALOG_PREFIX}" >> "$GITHUB_ENV"
           entries=$(find catalog-entries -name catalog-entry.json 2>/dev/null | sort || true)
           echo "count=$(echo -n "${entries}" | grep -c . || true)" >> "$GITHUB_OUTPUT"
@@ -584,7 +587,7 @@ jobs:
           {
             echo "### Vagrant box catalog"
             echo ""
-            echo "Catalog: ${CATALOG_URL}/ (\`VAGRANT_SERVER_URL\`)"
+            echo "Catalog: ${VAGRANT_SERVER_URL} (\`VAGRANT_SERVER_URL\`)"
             echo ""
           } > catalog-report.md
           # shellcheck disable=SC2046 # one argument per entry file
@@ -658,4 +661,4 @@ jobs:
 
             ${{ env.CATALOG_REPORT }}
 
-            Catalog: ${{ env.CATALOG_URL }}/
+            Catalog: ${{ env.VAGRANT_SERVER_URL }}

VAGRANT_BUILD_TEST_PUBLISH.md

@@ -159,9 +159,13 @@ disabled"), end of support on 2026-11-02, shutdown on 2026-12-31. The
   `10-x86_64_v2`, `10-kitten`, `10-kitten-x86_64_v2`) at
   `s3://<AWS_S3_BUCKET>/vagrant/almalinux/<box>` (and `<box>.json`), public,
   `Content-Type: application/json`;
-  `https://<AWS_S3_BUCKET>.s3.us-east-1.amazonaws.com/vagrant/` is the
-  address users set as `VAGRANT_SERVER_URL` (or `config.vm.box_url` to the
-  box's file).
+  **`https://vagrant.almalinux.org`** - CloudFront in front of the
+  bucket's `vagrant/` folder - is the address users set as
+  `VAGRANT_SERVER_URL` (or `config.vm.box_url` to
+  `https://vagrant.almalinux.org/almalinux/<box>`). The bucket's own address,
+  `https://<AWS_S3_BUCKET>.s3.us-east-1.amazonaws.com/vagrant`, serves the
+  same files; the publish job reads and checks the catalog there, as
+  CloudFront may serve a file up to its `max-age` (5 minutes) old.
 - **Boxes:** the `.box` files the build uploads to `images/.../vagrant/`;
   each catalog entry carries its S3 URL and sha256.
 - **Seed:** `tools/vagrant_catalog.py` built the whole catalog from a
@@ -213,6 +217,35 @@ for name in 10 10.json; do
 done
 ```
 
+### The catalog page
+
+[`tools/vagrant-catalog-index.html`](tools/vagrant-catalog-index.html) is
+the catalog's web page, at `https://vagrant.almalinux.org` itself: the
+boxes, with their providers, architectures and versions, how to use them,
+and every version's box files, sizes and checksums - what the HCP Vagrant
+Discover page showed. It is a single static file in the almalinux.org style
+that reads the catalog files (`almalinux/<box>.json` under the root it is
+served from, same origin) when it loads, so publishing needs no change to
+it. The bucket cannot be listed publicly, so its `BOXES` list names the
+catalog boxes: add a new catalog box there.
+
+`https://vagrant.almalinux.org/` serves the `vagrant/` object. S3 serves no
+index document, so the page is uploaded as that object, and also as
+`vagrant/index.html` and `vagrant` (the bucket's own addresses), by hand,
+when it changes:
+
+```bash
+for key in vagrant vagrant/ vagrant/index.html; do
+  aws s3api put-object --bucket almalinux-cloud --key "${key}" --body tools/vagrant-catalog-index.html \
+    --content-type 'text/html; charset=utf-8' --cache-control 'max-age=300' --tagging 'public=yes'
+done
+```
+
+The page shows each box's size with a `HEAD` request to its file, which on
+`vagrant.almalinux.org` is another origin (the bucket's address): the
+bucket's CORS configuration allows `GET`/`HEAD` from
+`https://vagrant.almalinux.org` for that. Without it the sizes show `-`.
+
 ## Workflow inputs
 
 The input set is [`vagrant-build.yml`](BUILD_VAGRANT.md)'s plus