Sharang ParnerkarandClaude Fable 5 881ef7b46a fix(ci): docker:27-cli image job; clear postcss and sharp HIGHs ...

Two fixes to make main ship an image again:

1. The image job used docker/login-action + build-push-action, which need
   a docker binary the runner's default job container does not have (the
   exact failure tenant-registry hit in run 5441). Rebuilt on the proven
   compliance build-push-deploy pattern: container docker:27-cli, plain
   docker login/build/push, cosign, then the HMAC-signed orca webhook
   over plain http like the proven compliance trigger-orca job.
2. trivy gate: postcss 8.4.31 (CVE-2026-45623, CVE-2026-73646) and sharp
   0.34.5 (GHSA-f88m-g3jw-g9cj) via pnpm overrides; lockfile resolves
   postcss 8.5.26 / sharp 0.35.4. Local trivy scan is clean; lint,
   typecheck, 100% coverage and build all pass locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

2026-08-31 17:44:51 +02:00

..

ci.yaml

fix(ci): docker:27-cli image job; clear postcss and sharp HIGHs

2026-08-31 17:44:51 +02:00

release.yaml

Repoint registry.breakpilot.com -> repo.breakpilot.com (Harbor) (#20)

2026-08-09 21:22:10 +00:00