build: publish qualified immutable Listmonk0.3.1 artifacts

jlxq0 commented

2026-10-29 01:57:52 +00:00

Owner

The release now builds and scans one attested OCI index, independently resolves its Linux/amd64 image configuration, and publishes that same index recursively under an immutable version tag. BuildKit omits its config-digest shortcut for attested indexes; the release gate follows and hashes the actual index, manifest and configuration instead. Conflicting tags, incomplete descriptors, mismatched scan identity, critical or fixable HIGH findings, and secrets are rejected.

This is deployment infrastructure carried by the fork, not an upstream submission. The master-only cache writer and stable-only latest tag behavior remain unchanged. Runtime authentication, provider behavior and the existing no-send policy are unchanged; deployment, Honoka transport credentials and approved publishing capability remain separate gates.

Validation at exact head 3100a306a6c9670dfa51bdac8b13f42e8faee66b: 254 tests, Ruff, Mypy, buildcache guard with 16 deliberate failure controls, and fresh independent Claude review all pass. Forge run38 has actual successful Python and Docker jobs. The image scan reports125packages,44unfixed OS HIGH findings,0critical,0fixable and0secrets; this is not a vulnerability-free claim. Earlier disposable-registry qualification covers recursive OCI/attestation preservation, identical replay, conflict and missing-descendant refusal. The eventual v0.3.1 tag artifact must pass its own qualification before deployment.

The release now builds and scans one attested OCI index, independently resolves its Linux/amd64 image configuration, and publishes that same index recursively under an immutable version tag. BuildKit omits its config-digest shortcut for attested indexes; the release gate follows and hashes the actual index, manifest and configuration instead. Conflicting tags, incomplete descriptors, mismatched scan identity, critical or fixable HIGH findings, and secrets are rejected. This is deployment infrastructure carried by the fork, not an upstream submission. The master-only cache writer and stable-only latest tag behavior remain unchanged. Runtime authentication, provider behavior and the existing no-send policy are unchanged; deployment, Honoka transport credentials and approved publishing capability remain separate gates. Validation at exact head `3100a306a6c9670dfa51bdac8b13f42e8faee66b`: 254 tests, Ruff, Mypy, buildcache guard with 16 deliberate failure controls, and fresh independent Claude review all pass. Forge run38 has actual successful Python and Docker jobs. The image scan reports125packages,44unfixed OS HIGH findings,0critical,0fixable and0secrets; this is not a vulnerability-free claim. Earlier disposable-registry qualification covers recursive OCI/attestation preservation, identical replay, conflict and missing-descendant refusal. The eventual v0.3.1 tag artifact must pass its own qualification before deployment.

jlxq0 added 3 commits

2026-10-29 01:57:52 +00:00

build: publish the scanned immutable Listmonk OCI artifact a609dca53f

fix: qualify secrets at every severity before publication 0f705c3850

fix: require positive inventory in the secret scan

CI / python (pull_request) Successful in 41s

Details

CI / docker (pull_request) Failing after 57s

Details

92ed430c12

jlxq0 added 2 commits

2026-10-29 08:43:05 +00:00