Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers.
Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations.
Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification.
Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.
Centralize component inputs and scoped Trivy policies. Replace the Buildx
source patch with compiled package-graph evidence.
Verify native amd64/arm64 images and publish the tested artifacts without
a second build. Add an explicit APT refresh path that reuses source caches.
Replace the brittle release-specific patch with an idempotent semantic Dockerfile transformation. Preserve the upstream package-manager version, reuse an existing npm refresh, and fail closed when required runtime anchors disappear.
Resolve the highest published DSH version, add scheduled component update checks, rebalance the workstation toolset, and retain the existing runtime and workstation targets.
Remove Rust/Cargo, restore pinned npm, add checksum-pinned development tools, build actionlint with the pinned Go toolchain, and reduce the workstation image by about 505 MiB while preserving cross-platform node-pty assets.
Validated by component-pin checks, runtime/workstation builds and smoke tests, dependency audits, Caddy checks, and Trivy gates.
Build committed amd64 runtime and workstation inputs without publishing, then exercise the existing dependency, smoke, Caddy, toolchain, and Trivy gates. Pin the Docker-socket Trivy fallback image by digest across the DeepSeek Harness workflows.
okxlin