Feedback from the first rollout: a default-off gate is the wrong way
around — the default must be active and enforced, with the opt-out as an
explicit, documented per-invocation emergency flag (same posture as the
image-scan gate).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
Reviewed-on: #5
Co-authored-by: peet <peet@noctrl.eu>
For directories whose bundled dependencies cannot be upgraded in place —
first user: the Android SDK cmdline-tools jars (old protobuf/guava et al.
inside sdkmanager) in the gitea-runner-android image. Callers must leave a
comment in the workflow explaining each exclusion.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
Reviewed-on: #4
Co-authored-by: peet <peet@noctrl.eu>
- android-signing: the keystore-restore step previously copy-pasted in
habitude and ablage-android; no-op without the secret (unsigned build).
- trivy-fs-scan: lockfile-based dependency scan for artifact-building
repos (APKs); non-blocking by default via enforce input.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
- podman-build-publish: reverted to pure build+push (v8 behavior) — the
Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
standardized on public/actions.
Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
New scan step between build and push: the built image is exported and
scanned with Trivy; fixable HIGH/CRITICAL findings fail the action and
block the push. Configurable via new scan / scan-severity inputs.
Implements noctrl.podman security review finding #16 (CI level).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
peetandClaude Fable 5