Skip to content

feat(release): harden template delivery workflows#18

Open
mwaldheim wants to merge 2 commits into
mainfrom
copilot/production-readiness-2026-07-24
Open

feat(release): harden template delivery workflows#18
mwaldheim wants to merge 2 commits into
mainfrom
copilot/production-readiness-2026-07-24

Conversation

@mwaldheim

@mwaldheim mwaldheim commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Summary

  • harden template CI, security, sync, tag orchestration, and release inputs with immutable action pins and strict SemVer/environment handling
  • build each OCI platform once, scan the immutable OCI layout, then promote only scanned digests and reconcile mutable tags safely
  • add publisher-docker to the 43-repository template-sync inventory

Validation

  • actionlint -no-color
  • golangci-lint run ./...
  • go test ./...
  • go build ./cmd/plugin
  • 43-repository scripts/verify-release-workflows.ps1
  • CI build/test/lint/scan, actionlint, dependency review, and REUSE gates

Linux/Docker runtime caveat

Local validation ran on Windows without a Docker daemon. Linux shell and Docker build/scan/promotion paths remain covered by CI.

@mwaldheim
mwaldheim force-pushed the copilot/production-readiness-2026-07-24 branch from 3f4f5ba to dda387f Compare July 24, 2026 12:33
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant