Repository navigation

fix(ci): P0 — publish templates/images only from master via protected environments + OIDC - #130

Open

lmeyerov wants to merge 9 commits into

dev/agent-skills-review-planfrom

dev/secure-publish-workflow

Open

fix(ci): P0 — publish templates/images only from master via protected environments + OIDC#130
lmeyerov wants to merge 9 commits into
dev/agent-skills-review-planfrom
dev/secure-publish-workflow

Commits on Oct 19, 2026
- fix(ci): restrict template + image publishing to master via protected environments and OIDC
  
  lmeyerov
  and
  claude
  committed
  b63e958
- fix(ci): job-level, ref-keyed concurrency for template publish
  
  lmeyerov
  and
  claude
  committed
  44c8860
- fix(ci): DockerHub publish only via master dispatch; validate cuda_versions
  
  lmeyerov
  and
  claude
  committed
  bb936b9
- docs: ordered publish setup runbook (lock envs first, verify, then retire keys)
  
  lmeyerov
  and
  claude
  committed
  2be73df
- docs+ci: close self-approval path to master; fix DockerHub release docs
  
  lmeyerov
  and
  claude
  committed
  f44900e
- docs: runbook ordering for read-only default + credential retirement; audit other secrets
  
  lmeyerov
  and
  claude
  committed
  da21a05
- docs: wave-4 runbook polish (two reviewers, post-merge read-only default, no-bypass)
  
  lmeyerov
  and
  claude
  committed
  fd49fbf
- fix(ci): accept graphistry CI's CUDA values (13/12) in dockerhubpublish; document the chain
  
  lmeyerov
  and
  claude
  committed
  bc8c03b
- docs: generic repo-secret guidance; specifics tracked internally
  
  lmeyerov
  and
  claude
  committed
  ba87f14