- Updated Docker Compose files to use digest-pinned images for CI contexts.
- Enhanced Dockerfile to pin Go tool installations and verify external downloads with SHA256 checksums.
- Added Renovate configuration for tracking Go tool versions and digest updates.
- Introduced a new design document outlining the architecture and data flow for dependency tracking.
- Created tasks and requirements documentation to ensure compliance with the new digest pinning policy.
- Updated security documentation to reflect the new digest pinning policy and exceptions.
GitHub Actions doesn't allow secrets context in step if expressions.
Add HAS_DOCKERHUB_TOKEN env var at job level that evaluates the secret
existence, then reference that env var in step conditions.
Fixes: "Unrecognized named-value: 'secrets'" workflow validation error
Publish Docker images to both Docker Hub (docker.io/wikid82/charon) and
GitHub Container Registry (ghcr.io/wikid82/charon) for maximum reach.
Add Docker Hub login with secret existence check for graceful fallback
Update docker/metadata-action to generate tags for both registries
Add Cosign keyless signing for both GHCR and Docker Hub images
Attach SBOM to Docker Hub via cosign attach sbom
Add Docker Hub signature verification to supply-chain-verify workflow
Update README with Docker Hub badges and dual registry examples
Update getting-started.md with both registry options
Supply chain security maintained: identical tags, signatures, and SBOMs
on both registries. PR images remain GHCR-only.
Update nightly-build.yml to automatically merge changes from development
branch to nightly before running the build. This enables a workflow where
PRs only need to target development, and nightly builds propagate
automatically.
Add sync-development-to-nightly job that runs first
Remove push trigger on nightly branch (sync handles updates)
All jobs now explicitly checkout nightly branch after sync
Uses fast-forward merge or hard reset if diverged
GHCR stores images with lowercase names only. The SBOM action was using
the mixed-case github.repository value which caused Syft to fail when
trying to pull the image.
Add IMAGE_NAME_LC environment variable with lowercase image name
Update SBOM action, Trivy scan, and docker commands to use lowercase
Applied to all jobs: build-and-push-nightly, test-nightly-image,
verify-nightly-supply-chain
Fixes nightly-build.yml workflow failure in "Generate SBOM" step
renovate[bot]
GitHub Actions
Jeremy