Chris Lu 327e8b682c docker release: copy and sign the digest the run created, pin the rest ...

crane copy and the signature both resolved the tag, which another
publisher could move between the two steps. The index digest is read once,
right after it is created, and the Docker Hub copy and both signatures use
it. The manual latest rebuild gets the same treatment. The actions in these
jobs are pinned to commits, crane to v0.22.0 by checksum, and the sparse
checkout no longer keeps the token.

Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa

2026-09-03 11:02:45 -07:00

..

binaries_dev.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

binaries_release0.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

binaries_release1.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

binaries_release2.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

binaries_release3.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

binaries_release4.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

binaries_release5.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

codeql.yml

build(deps): bump github/codeql-action from 4.37.8 to 4.37.9 (#11045)

2026-08-31 09:49:16 -07:00

codespell.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

container_dev.yml

ci: pin every action in the jobs that sign

2026-09-03 11:02:45 -07:00

container_foundationdb_version.yml

ci: pin every action in the jobs that sign

2026-09-03 11:02:45 -07:00

container_latest.yml

docker release: copy and sign the digest the run created, pin the rest

2026-09-03 11:02:45 -07:00

container_release_foundationdb.yml

ci: pin every action in the jobs that sign

2026-09-03 11:02:45 -07:00

container_release_unified.yml

docker release: copy and sign the digest the run created, pin the rest

2026-09-03 11:02:45 -07:00

container_rocksdb_version.yml

docker: sign the per-version foundationdb and rocksdb builds

2026-09-03 09:14:00 -07:00

deploy_telemetry.yml

ci: fix Deploy Telemetry Server build (nested telemetry/server module) (#10398)

2026-07-22 19:17:26 -07:00

depsreview.yml

build(deps): bump actions/checkout from 6 to 7 (#10451)

2026-07-27 12:47:43 -07:00

e2e.yml

ci: call the apt helper from the workflow's working directory (#10832)

2026-08-19 00:46:32 -07:00

ec-integration-tests.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

fuse-dlm-integration.yml

ci: stop installing FUSE headers nothing links against (#10840)

2026-08-19 14:09:40 -07:00

fuse-failover.yml

ci: stop installing FUSE headers nothing links against (#10840)

2026-08-19 14:09:40 -07:00

fuse-integration.yml

ci: stop installing FUSE headers nothing links against (#10840)

2026-08-19 14:09:40 -07:00

fuse-p2p-integration.yml

ci: stop installing FUSE headers nothing links against (#10840)

2026-08-19 14:09:40 -07:00

go.yml

ci: run the gated redis store tests (#10746)

2026-08-13 13:36:31 -07:00

helm_ci.yml

helm: install chart CI against an image tag that exists (#10877)

2026-08-22 09:42:28 -07:00

helm_manual_release.yml

build(deps): bump actions/checkout from 6 to 7 (#10037)

2026-06-22 09:55:11 -07:00

java_integration_tests.yml

build(deps): bump actions/setup-java from 5 to 6 (#11047)

2026-08-31 09:49:46 -07:00

java_release.yml

build(deps): bump actions/setup-java from 5 to 6 (#11047)

2026-08-31 09:49:46 -07:00

java_unit_tests.yml

build(deps): bump actions/setup-java from 5 to 6 (#11047)

2026-08-31 09:49:46 -07:00

kafka-quicktest.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

kafka-tests.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

kms-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

master-cold-start-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

metadata-subscribe-tests.yml

filer: rebuild peer metadata subscriptions after a master reconnect (#10648)

2026-08-08 10:28:25 -07:00

mount-benchmark.yml

build(deps): bump actions/upload-artifact from 4 to 7 (#10922)

2026-08-24 15:17:51 -07:00

mount-windows-conformance.yml

volume: skip directory fsync on Windows, report a failed makeupDiff (#10572)

2026-08-04 21:02:52 -07:00

mount-windows.yml

volume: skip directory fsync on Windows, report a failed makeupDiff (#10572)

2026-08-04 21:02:52 -07:00

multi-master-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

performance.yml

ci: build protoc into the crate instead of installing it per job (#10830)

2026-08-19 00:18:30 -07:00

pjdfstest.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

plugin-workers.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

postgres-tests.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

release_version_bump.yml

release: judge downstream releases by their run, excluding runner-queue time (#11057)

2026-08-31 20:56:39 -07:00

rust_binaries_dev.yml

ci: build protoc into the crate instead of installing it per job (#10830)

2026-08-19 00:18:30 -07:00

rust_binaries_release.yml

Build the Rust worker against the protoc that ships with the build (#10881)

2026-08-22 11:34:33 -07:00

rust-volume-server-tests.yml

ci: build protoc into the crate instead of installing it per job (#10830)

2026-08-19 00:18:30 -07:00

rust-worker-tests.yml

Build the Rust worker against the protoc that ships with the build (#10881)

2026-08-22 11:34:33 -07:00

s3-etag-acl-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-example-integration-tests.yml

S3: let a key that is a prefix of other keys be an object (#10912)

2026-08-24 15:10:34 -07:00

s3-filer-group-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-go-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-iam-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-keycloak-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-mutation-regression-tests.yml

s3: give a versioned metadata-only copy its own chunks (#10594)

2026-08-05 20:29:28 -07:00

s3-parquet-tests.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

s3-policy-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-proxy-signature-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-sdk-v2-routing-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-spark-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-sse-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

s3-tables-tests.yml

test: drive the Lance namespace with Spark (#10864)

2026-08-21 23:49:09 -07:00

s3tests.yml

test(s3): give the copying suite room for a collection per bucket (#10590)

2026-08-05 12:55:35 -07:00

samba-integration.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

sftp-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

spark-integration-tests.yml

build(deps): bump actions/setup-java from 5 to 6 (#11047)

2026-08-31 09:49:46 -07:00

telemetry-integration.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

terraform_ci.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

test-s3-over-https-using-awscli.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

tls-rotation-tests.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

tus-tests.yml

build(deps): bump actions/setup-go from 6 to 7 (#10370)

2026-07-20 17:47:58 -07:00

vacuum-integration-tests.yml

go 1.26 (#10797)

2026-08-17 15:39:20 -07:00

volume-server-integration-tests.yml

ci: deal volume server tests across shards instead of bucketing by letter (#10576)

2026-08-04 21:42:34 -07:00