release-factory

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
okxlin	a517aa175f	fix: repair scheduled image dependency security gates (#108 ) Refresh Gemini, Paseo and OpenCode production dependency graphs; repair code-server dependency bundles and proxy-core binaries. Preserve consumer APIs, transactional rollback and the existing Trivy security policy. Validated native amd64/arm64 workstation build and runtime smoke, both browser variants and eight policy replays at `6959d03001`.	2026-10-27 10:08:50 +08:00
okxlin	c09c22db85	fix: restore scheduled image builds and security checks (#100 ) * fix: restore image security gates and OpenClaw sandbox verification * fix: refresh proxy Go toolchain and code-server shell quoting	2026-10-12 18:26:23 +08:00
okxlin	e058ba3f73	fix(images): harden runtimes and publish verified artifacts (#85 ) Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers. Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations. Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification. Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.	2026-09-13 01:52:07 +08:00

a517aa175f

fix: repair scheduled image dependency security gates (#108 )

Refresh Gemini, Paseo and OpenCode production dependency graphs; repair code-server dependency bundles and proxy-core binaries. Preserve consumer APIs, transactional rollback and the existing Trivy security policy.

Validated native amd64/arm64 workstation build and runtime smoke, both browser variants and eight policy replays at 6959d03001.

2026-10-27 10:08:50 +08:00

okxlin

c09c22db85

fix: restore scheduled image builds and security checks (#100 )

* fix: restore image security gates and OpenClaw sandbox verification

* fix: refresh proxy Go toolchain and code-server shell quoting

2026-10-12 18:26:23 +08:00

okxlin

e058ba3f73

fix(images): harden runtimes and publish verified artifacts (#85 )

Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers.

Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations.

Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification.

Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.

2026-09-13 01:52:07 +08:00