boban 4af1633ca9 fix(install): harden release-image resolver — safe build fallback, ghcr digest allowlist, lint + CI coverage ... Review found the build fallback could inherit a stale digest pin (compose build aborts), a slash-shaped/non-ghcr lock ref caused a doomed pull, env mode never persisted the pin (host restart used a nonexistent default tag), and the resolver test was unlinted/unrun in CI. Resolver now always leaves a coherent pin, validates ghcr.io/<owner>/<name>@sha256 refs only, exports the mode flag (drops the file-level shellcheck disable), and CI lints + runs the script unit tests.		2026-07-03 21:27:30 +02:00
..
workflows	fix(install): harden release-image resolver — safe build fallback, ghcr digest allowlist, lint + CI coverage	2026-07-03 21:27:30 +02:00
actionlint.yaml	ci: test on v* tags, optional self-hosted staging deploy on betas	2026-06-22 21:03:14 +02:00