Skip to content

ci: bootstrap GHCR with GitHub Actions - #74

Merged
kricha-lab-dev-worker[bot] merged 1 commit into
mainfrom
feat/ghcr-bootstrap-workflow
Sep 1, 2026
Merged

ci: bootstrap GHCR with GitHub Actions#74
kricha-lab-dev-worker[bot] merged 1 commit into
mainfrom
feat/ghcr-bootstrap-workflow

Conversation

@kricha-lab-dev-worker

Copy link
Copy Markdown
Contributor

Summary

  • add a dispatch-only GHCR bootstrap workflow using the repository GITHUB_TOKEN
  • publish only bootstrap-<exact-main-sha> with multi-arch SBOM and provenance
  • structurally enforce exact workflow triggers, permissions, pins, steps, tags, and cleanup
  • replace the manual PAT bootstrap instructions

Verification

  • GHCR structural contract and 8 negative fixtures: PASS
  • chained OCI contract: PASS
  • OCI helper tests: 16/16 PASS
  • YAML/Bash/Python syntax: PASS
  • go test ./..., go vet ./..., go build ./...: PASS
  • independent exact-tree review: PASS

Refs #43

@kricha-lab-dev-worker
kricha-lab-dev-worker Bot merged commit 5273437 into main Sep 1, 2026
5 checks passed
@kricha-lab-dev-worker
kricha-lab-dev-worker Bot deleted the feat/ghcr-bootstrap-workflow branch September 1, 2026 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant