agentandClaude Opus 5.5 f08fce4ab6 ci: refuse to re-publish an existing image tag (zegit#262) ...

A dispatch for 12.11.1-ci7 without sign_only rebuilt and re-pushed the
tag. The registry dropped the old manifest, so flux-config's
12.11.1-ci7@sha256:86d7e3b4 pin now 404s on the next pull. That is the
zegit#143 threat shape, done by accident. Like zegit-arc-runner, a build
now refuses a tag the registry already holds, and sign_only refuses one
it does not.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

2026-10-19 14:25:29 +02:00

..

build-image-gitea.yml

ci: refuse to re-publish an existing image tag (zegit#262)

2026-10-19 14:25:29 +02:00

build-image.yml

chore(ci): assert the busybox/coreutils layer, and record the derived audit

2026-08-31 20:53:32 +02:00