2 Commits

Author	SHA1	Message	Date
dependabot[bot]	94406a8280	chore(deps): bump the all-actions group across 2 directories with 3 updates (#1440) ... Bumps the all-actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Bumps the all-actions group with 1 update in the /.github/actions/start-app directory: [actions/cache](https://github.com/actions/cache). Updates `actions/checkout` from 6.0.3 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b) Updates `actions/cache` from 5.0.5 to 6.0.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...2c8a9bd7457de244a408f35966fab2fb45fda9c8) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: actions/cache dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-24 16:15:11 -04:00
Anso	3dc8199907	ci: publish a dev integration image on every push to main (#1343) ... Add docker-dev.yml: on each push to main (and manual dispatch) it builds the multi-arch image, runs the same Trivy and smoke-test gates as the release build, and pushes ghcr.io/studio-saelix/sencho-dev with the tags :dev (moving) and :dev-<short-sha> (immutable), so a maintainer can pull and test the exact artifact queued for the next release before it can become a public release. The integration path is GHCR-only and non-promotable: no Docker Hub, no latest/semver tags, no cosign signing, no SBOM/VEX, and no GitHub Release. All of that stays release-only in docker-publish.yml, driven by v* tags. Least-privilege permissions (contents:read, packages:write) and no production environment, so dev images publish automatically with no Docker Hub credentials in scope. Also add a clarifying header comment to docker-publish.yml noting it is the release-only path.	2026-06-09 19:58:44 -04:00