15 Commits

Author	SHA1	Message	Date
Vladimir Dubrovin	db2f57fdd2	Sign packages, publish checksums, attest before upload, narrow permissions ... GPG signing of rpm packages and detached signatures for deb packages and for the SHA256SUMS files, using GPG_PRIVATE_KEY / GPG_PASSPHRASE secrets. Checksums are published as release assets. Build provenance is attested before the assets are uploaded, so a failed attestation does not leave unattested files published. Workflow permissions are read-only, write permissions are requested per job only where they are used.	2026-08-21 11:08:20 +03:00
Vladimir Dubrovin	3dfd9052be	Rework docker workflow, add build provenance attestations ... Docker: single workflow, one job per image per platform instead of one workflow per registry. Platforms are built in parallel and pushed by digest, then combined into a manifest list pushed to Docker Hub and GHCR at once, so both registries get identical digests. arm64 and arm/v7 build on native arm runners, ppc64le is dropped. Registry provenance/sbom attestations are disabled (they were shown as unknown/unknown entries in the registries), build provenance is attested with actions/attest-build-provenance instead and is verifiable with 'gh attestation verify oci://...'. Release binaries (rpm, deb, zip) are attested the same way. cosign version is pinned and images are signed by digest.	2026-08-20 20:04:00 +03:00
Vladimir Dubrovin	8e2732b323	Use lts docker tags in 0.9 branch ... Release images built from the 0.9 branch are tagged lts / lts-busybox / lts-minimal instead of latest / busybox / minimal, so master keeps the latest tags. Version tags are unchanged.	2026-08-20 19:04:48 +03:00
dependabot[bot]	d77dc00fd1	Bump actions/checkout from 6 to 7 (#1241) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:54:36 +03:00
Vladimir Dubrovin	757ad916ec	Sign docker images	2026-06-02 18:12:48 +03:00
Vladimir Dubrovin	74d5b67ef4	riscv64 removed due to lack of gcc image	2026-06-01 20:27:47 +03:00
dependabot[bot]	6d8643b70e	Bump actions/checkout from 5 to 6 (#1234) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 5 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-01 20:22:52 +03:00
Vladimir Dubrovin	794f667eea	Add more docker platforms	2026-06-01 20:16:19 +03:00
Vladimir Dubrovin	9734b54f56	Add permissions to workflows	2026-06-01 14:29:32 +03:00
Vladimir Dubrovin	fe2b2fd544	Revert "send provenance to github only" ... This reverts commit 254112cfde.	2026-06-01 13:27:41 +03:00
Vladimir Dubrovin	254112cfde	send provenance to github only	2026-06-01 10:48:02 +03:00
Vladimir Dubrovin	997671ee16	publish builds on release	2026-05-31 15:29:11 +03:00
Vladimir Dubrovin	34e9c453fa	Workflows update	2026-05-31 13:47:41 +03:00
Vladimir Dubrovin	3dde2de498	do not keep untagged dockers	2026-05-31 13:10:26 +03:00
Vladimir Dubrovin	bdf9946fe5	Add dockers build	2026-05-30 17:05:43 +03:00