Run 18249 (a dispatch for 12.11.1-ci7 without sign_only) rebuilt and re-pushed ci7. The tag moved from sha256:86d7e3b4… to sha256:a871a50c…, and Gitea dropped the old manifest (it now 404s). flux-config pins the old digest in 4 places, so the next pod start would fail to pull it.
This adds the same immutability rule zegit-arc-runner already has. On workflow_dispatch the meta step lists the registry's tags. A build refuses a tag that already exists; sign_only refuses a tag that doesn't. Push-triggered validation runs are unchanged.
actionlint shows no new findings; the existing infos are in the toolchain-assert step only.
Run 18249 (a dispatch for 12.11.1-ci7 without sign_only) rebuilt and re-pushed ci7. The tag moved from sha256:86d7e3b4… to sha256:a871a50c…, and Gitea dropped the old manifest (it now 404s). flux-config pins the old digest in 4 places, so the next pod start would fail to pull it.
This adds the same immutability rule zegit-arc-runner already has. On workflow_dispatch the meta step lists the registry's tags. A build refuses a tag that already exists; sign_only refuses a tag that doesn't. Push-triggered validation runs are unchanged.
actionlint shows no new findings; the existing infos are in the toolchain-assert step only.
Agent-Session: c7a4654f-faaa-5aa6-b87c-7b01232bed27
A dispatch for 12.11.1-ci7 without sign_only rebuilt and re-pushed the
tag. The registry dropped the old manifest, so flux-config's
12.11.1-ci7@sha256:86d7e3b4 pin now 404s on the next pull. That is the
zegit#143 threat shape, done by accident. Like zegit-arc-runner, a build
now refuses a tag the registry already holds, and sign_only refuses one
it does not.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
agent
marked the pull request as ready for review 2026-10-19 12:25:39 +00:00
markus
merged commit 9608037173 into master2026-10-19 12:32:29 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Run 18249 (a dispatch for 12.11.1-ci7 without sign_only) rebuilt and re-pushed ci7. The tag moved from sha256:86d7e3b4… to sha256:a871a50c…, and Gitea dropped the old manifest (it now 404s). flux-config pins the old digest in 4 places, so the next pod start would fail to pull it.
This adds the same immutability rule zegit-arc-runner already has. On workflow_dispatch the meta step lists the registry's tags. A build refuses a tag that already exists; sign_only refuses a tag that doesn't. Push-triggered validation runs are unchanged.
actionlint shows no new findings; the existing infos are in the toolchain-assert step only.
Agent-Session: c7a4654f-faaa-5aa6-b87c-7b01232bed27