public/actions
Public Access
1
0 Fork 0
Code Pull Requests Actions Activity

Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions #2

Merged
peet merged 1 commits from build-scan-promote into main 2026-08-29 13:51:21 +02:00
Conversation 0 Commits 1 Files Changed 5
+271 -75
peet commented 2026-08-29 13:51:13 +02:00
Owner
Copy link
Copy source
  • podman-build-publish: reverted to pure build+push (v8 behavior) — the
    Trivy gate briefly embedded in v10 moves to an explicit action instead.
  • trivy-scan (new): scans a registry image ref, fails on fixable
    HIGH/CRITICAL findings; jobs pin it to amd64 runners.
  • podman-promote (new): server-side retag via skopeo copy --all — releases
    promote the scanned sha- candidate instead of rebuilding.
  • deploy-prod (new): shared deploy body for the *.podman repos (with the
    BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
  • README: documents the standard build.yml/release.yml pipeline; refs
    standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

- podman-build-publish: reverted to pure build+push (v8 behavior) — the Trivy gate briefly embedded in v10 moves to an explicit action instead. - trivy-scan (new): scans a registry image ref, fails on fixable HIGH/CRITICAL findings; jobs pin it to amd64 runners. - podman-promote (new): server-side retag via skopeo copy --all — releases promote the scanned sha-<commit> candidate instead of rebuilding. - deploy-prod (new): shared deploy body for the *.podman repos (with the BatchMode/IdentitiesOnly ssh flags only two of the four copies had). - README: documents the standard build.yml/release.yml pipeline; refs standardized on public/actions. Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
peet added 1 commit 2026-08-29 13:51:13 +02:00
Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions 0807dc6434 
- podman-build-publish: reverted to pure build+push (v8 behavior) — the
  Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
  HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
  promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
  BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
  standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
peet merged commit 01bc638759 into main 2026-08-29 13:51:21 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
peet
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: public/actions#2