feat(ci): run the merge gate inside the CI-built toolbox image, pinned by digest #147

Merged
jakman85 merged 4 commits from feat/gate-toolbox-container into main 2026-11-08 06:51:00 +00:00
Showing only changes of commit 514ed5d5a4 - Show all commits
@@ -69,7 +69,12 @@ new recurring operator touch.
yamllint/promtool pins are altered.
- Renovate marker regex (copied from renovate.json5) matches gate.yml exactly once, capturing
depName/tag/digest.
- LOCAL GATE: see below (filled after the run).
- LOCAL GATE, run **in the pinned CI image itself** (`IMAGE=<the digest above>` through
`dev.sh`, `DEV_KUBECONFIG=/dev/null`, ENGINE shim adding the main checkout's `.git` read-only),
on commit `9537ca2`: **rc 3**; spec-immutability, decisions-log (78 entries), lint, l0,
render-golden, l1, approval-policy (N/A locally — not a PR event) all pass; **gitea-settings
the only stage not run** (no `SETTINGS_API_TOKEN` locally); L2/L3 conformance skipped as
usual. rc 3 is not green.
## What I did NOT verify