97ee636e49Two bugs surfaced during first real pipeline run: 1. Containerfile: goreleaser and syft downloaded to renamed files (goreleaser.tar.gz, syft.tar.gz) but sha256sum -c expected the original release filenames. Download now uses original names so sha256sum -c resolves them correctly. 2. build-image task: privileged: true required for buildah on this OpenShift cluster. The pipeline SA has been granted privileged SCC in op1st-pipelines namespace (scoped grant, standard CI pattern). Rootless alternatives (--isolation=chroot, --userns=host) both fail due to nested user namespace restrictions even with anyuid SCC. Closes forgejo-mcp-aps |
||
|---|---|---|
| .. | ||
| release-tools/tasks | ||
| tasks | ||
| code-scans.yaml | ||
| on-pull-request.yaml | ||
| on-push-to-main.yaml | ||
| on-tag-push-release.yaml | ||
| openspec-validate-pr.yaml | ||
| openspec-validate-push.yaml | ||
| release-tools-on-pull-request-build.yaml | ||
| release-tools-on-tag-publish.yaml | ||
| repository.yaml | ||