- podman-build-publish: reverted to pure build+push (v8 behavior) — the
Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
standardized on public/actions.
Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
