feat(supply-chain): sign published images, add a chart image inventory, and correct the self-hosting docs - #7432

Closed

waleedlatif1 wants to merge 14 commits into

stagingfrom

feat/supply-chain-attestations

Commits on Sep 3, 2026

feat(supply-chain): sign published images and generate the chart image inventory

waleedlatif1
and
claude
committed
2cbdbf1
docs(self-hosting): correct claims that contradict the source

waleedlatif1
and
claude
committed
b382450
docs(self-hosting): fix errors found verifying the correction pass

waleedlatif1
and
claude
committed
4b3028a
chore(helm): bump chart version for the image inventory addition

waleedlatif1
and
claude
committed
212a063
fix(supply-chain): attest every pullable tag, and correct docs from review

waleedlatif1
and
claude
committed
aec4d32
docs: fix prose defects found auditing the edited pages end to end

waleedlatif1
and
claude
committed
433f859
fix(supply-chain): attest the real published tags, and make the GPU image mirrorable

waleedlatif1
and
claude
committed
db622ae
fix(docs): scope the Trigger.dev requirement to data drains

waleedlatif1
and
claude
committed
d3ae845
fix(supply-chain): never attest a moving tag this run did not publish

waleedlatif1
and
claude
committed
af7ab4b
fix(supply-chain): fail on an unresolvable tag instead of silently skipping it

waleedlatif1
and
claude
committed
f8aceb3
fix(supply-chain): retry absence too, so a slow alias is not mistaken for a missing one

waleedlatif1
and
claude
committed
a49760d
fix(supply-chain): fail a release whose version tag is not this run's index

waleedlatif1
and
claude
committed
6a3ac59
fix(supply-chain): scan the plain manifest so the SBOM step can run at all

waleedlatif1
and
claude
committed
2dc5476
fix(supply-chain): derive the mirror path instead of describing a rule for it

waleedlatif1
and
claude
committed
c042b17

Navigation Menu

Uh oh!

feat(supply-chain): sign published images, add a chart image inventory, and correct the self-hosting docs - #7432

feat(supply-chain): sign published images, add a chart image inventory, and correct the self-hosting docs#7432
waleedlatif1 wants to merge 14 commits into
stagingfrom
feat/supply-chain-attestations

Commits on Sep 3, 2026

feat(supply-chain): sign published images and generate the chart image inventory

docs(self-hosting): correct claims that contradict the source

docs(self-hosting): fix errors found verifying the correction pass

chore(helm): bump chart version for the image inventory addition

fix(supply-chain): attest every pullable tag, and correct docs from review

docs: fix prose defects found auditing the edited pages end to end

fix(supply-chain): attest the real published tags, and make the GPU image mirrorable

fix(docs): scope the Trigger.dev requirement to data drains

fix(supply-chain): never attest a moving tag this run did not publish

fix(supply-chain): fail on an unresolvable tag instead of silently skipping it

fix(supply-chain): retry absence too, so a slow alias is not mistaken for a missing one

fix(supply-chain): fail a release whose version tag is not this run's index

fix(supply-chain): scan the plain manifest so the SBOM step can run at all

fix(supply-chain): derive the mirror path instead of describing a rule for it