Description
The runtime image publishes through the shared container-publish reusable rather than a hand-rolled job. A caller pinned to an old release does not receive a fix landed after it, so the pin is part of the task.
Acceptance Criteria
- #1 publish.yml calls rknightion/.github container-publish.yml pinned to a release SHA with the version in a trailing comment
- #2 ghcr-cleanup.yml is wired from the same release
- #3 The publish workflow takes one shared concurrency group for the whole repo with cancel-in-progress false
- #4 Permissions on the reusable call are derived from a working caller in another repo, not copied blind
- #5 Trivy actually scans the built artifact rather than skipping it; the scan output is read, not assumed
Definition of Done
- #1 just check passes: fmt-check, lint, build, test-short, probe-ci, dashboard-check and docs-links all clean
Implementation Plan
Wave 1 lane 11: root creates additive OpenBao/GitHub release plumbing from live sibling shape, wires shared workflows and repository settings, then proves the release broker mint step and release PR.
Final Summary
Pinned shared publish and cleanup workflows use serialized release concurrency; run 35718855219 built, scanned, published, signed and attested the edge image.