feat(delivery): publish signed commit-pinned Omada runner

Andreas commented

2026-10-02 18:34:51 +00:00

Owner

Build the fork into the exact deployed tf-runner/OpenTofu base using a normal filesystem mirror, not dev_overrides. Preserve the non-root user and entrypoint. Offline tests cover init, read-only lock reuse, write-only schema fields and corrupted-package checksum rejection. Main-only publishing uses the reviewed pinned shared image publisher with existing signing/attestation/SBOM verification and immutable Git-SHA tags; PRs never publish. Renovate tracks the shared publisher while controller-synchronized engine upgrades remain explicitly held. No production runner, state, account, credential or network change. Production adoption remains gated on independent signature verification, rollback preflight and read-only no-change ownership-transfer proof.

Andreas added 2 commits

2026-10-02 18:34:51 +00:00

feat(delivery): publish signed commit-pinned Omada runner 78656a8200

test(delivery): enforce offline checksums and non-root cleanup

Validate and package Omada provider / provider (pull_request) Failing after 4m26s

Details

bc12666afd

Andreas added 1 commit

2026-10-02 18:43:40 +00:00

fix(ci): clean disposable proof in rootful and rootless Podman

Validate and package Omada provider / provider (pull_request) Successful in 3m46s

Details