Oliver Kieselbach 47dad7143f docs(ci): tighten the code-signing comments in build-agent ...

Public repo: keep the reasoning that a later change could break -- signing must precede
the release hashes, the job must never carry an environment, the timestamp is not
optional -- and drop the rest. Comments only, no behaviour change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-08 19:20:39 +02:00

..

bootstrap-script-gates.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00

build-agent.yml

docs(ci): tighten the code-signing comments in build-agent

2026-09-08 19:20:39 +02:00

build-msi.yml

ci: workflows authorize Azure Storage with the federated identity, not SAS secrets (D-222)

2026-09-08 17:38:14 +02:00

ci.yml

ci: workflow-only commits no longer trigger CI and CodeQL

2026-09-04 16:05:21 +02:00

codeql.yml

ci: workflow-only commits no longer trigger CI and CodeQL

2026-09-04 16:05:21 +02:00

combine-rules.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

deploy-backend.yml

ci: workflows authorize Azure Storage with the federated identity, not SAS secrets (D-222)

2026-09-08 17:38:14 +02:00

deploy-mcp.yml

ci: workflows authorize Azure Storage with the federated identity, not SAS secrets (D-222)

2026-09-08 17:38:14 +02:00

deploy-web.yml

ci: workflows authorize Azure Storage with the federated identity, not SAS secrets (D-222)

2026-09-08 17:38:14 +02:00

indexnow-notify.yml

added valid return codes

2026-03-20 08:21:04 +01:00

oidc-login-test.yml

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

pester.yml

ci(scripts): publish customer scripts on push, decoupled from the agent release

2026-08-19 15:09:33 +02:00

publish-scripts.yml

feat(bootstrap): two-stage loader and Authenticode-signed customer scripts (D-224)

2026-09-08 18:48:21 +02:00