12 Commits

Include renames

Author	SHA1	Message	Date
KyuubiYoru	d41fa0c7e9	fix(release): repair tag gate and sibling-container publication (#1) ... The release workflow could not complete on the self-hosted sibling-container runner. Four defects are corrected together because three of them share the same release.yml plumbing. Exclude the tag under release from the prior-tag probe. check-release-tag.sh already requires the tag to point at HEAD, so the unfiltered listing always matched itself and rejected every first release before the initial baseline branch could run. Resolve host bind sources once per job. Steps run inside the runner container while docker run starts siblings on the host daemon, so GITHUB_WORKSPACE and RUNNER_TEMP are not usable as bind sources. A new step maps both to host paths through the runner's own mounts and exports them; the build, provenance, smoke, finalize, and publish steps reuse them, and publish-release.sh receives them by environment instead of repeating the inspection. Bind destinations stay at the container-internal paths so runner-side reads keep working unchanged. Prove the signing material before the first push. Gitea package versions are immutable, so a missing or undecryptable cosign key must abort ahead of the require_absent gate rather than after packages and the image are published. Authenticate the pinned consumer fetches. Both consumer repositories are private, so anonymous fetches fail; the release token is passed to the verification step and applied as a URL-scoped extra header through git's config environment, keeping it out of argv, remotes, and on-disk config. Anonymous fetch remains the fallback for local runs.	2026-08-22 19:47:57 +02:00
KyuubiYoru	589f802e2e	fix(ci): smoke through service namespace (#1)	2026-07-17 02:16:21 +02:00
KyuubiYoru	4423503bba	fix(ci): reduce readiness probe pressure (#1)	2026-07-17 02:06:39 +02:00
KyuubiYoru	74ae126ea7	fix(ci): allow cold container startup (#1)	2026-07-17 01:59:30 +02:00
KyuubiYoru	a77d4b801c	fix(ci): isolate deployment smoke client (#1)	2026-07-17 01:53:50 +02:00
KyuubiYoru	769336e424	fix(ci): run smoke on Compose network (#1)	2026-07-17 01:42:28 +02:00
KyuubiYoru	41be7fbce5	fix(ci): join service to runner network (#1)	2026-07-17 01:36:47 +02:00
KyuubiYoru	1bca034a52	fix(ci): route smoke through Docker gateway (#1)	2026-07-17 01:29:30 +02:00
KyuubiYoru	8d98d888b3	fix(ci): resolve sibling-container bind sources (#1)	2026-07-17 01:23:16 +02:00
KyuubiYoru	f9cb7f47e5	fix(ci): isolate Compose host ports (#1)	2026-07-17 01:07:56 +02:00
KyuubiYoru	d42e6c99a3	fix(ci): provision TestClient runtime (#1)	2026-07-17 00:42:16 +02:00
KyuubiYoru	cc5793f935	feat(release): add reproducible signed artifacts (#19)	2026-07-16 17:48:21 +02:00