365e43cdea fix(renovate): run Renovate as the job container; the action needs a Docker daemon jobs do not get
gitea-admin created branch fix/renovate-first-run in Home-Network/home-network-k3s-impl 2026-10-30 06:26:58 +00:00
7f0cbc7ba2 feat(pm-agent): pin the first published agent-runner digest, start dry, and fix the token scopes
a7eadd4054 feat(pm-agent): the kubelet's pull credential, and the seventh field admission had not read
dfc432c6ea Merge pull request 'fix(keycloak-passkey): passkey reconciler with review fixes — bind only on git's say-so (default false), protect real sub-flows, body-id screening, failure alert' (#82) from feat/keycloak-passkey-reconcile into main
262c6e4a97 Merge branch 'main' into feat/keycloak-passkey-reconcile
523cd9118f Merge pull request 'fix(buildkit): allow buildkitd egress to Gitea so the Gateway stops 403ing the registry push' (#83) from fix/gitea-admit-buildkit into main
Compare 56 commits »
gitea-admin created pull request Home-Network/home-network-k3s-impl#83 2026-10-30 05:41:23 +00:00
fix(buildkit): allow buildkitd egress to Gitea so the Gateway stops 403ing the registry push
d2c4bd5194 fix(buildkit): allow buildkitd egress to Gitea's backend so the Gateway stops 403ing the push
gitea-admin created branch fix/gitea-admit-buildkit in Home-Network/home-network-k3s-impl 2026-10-30 05:40:46 +00:00
gitea-admin pushed to feat/image-pipeline at Home-Network/home-network-k3s-impl 2026-10-30 05:01:45 +00:00
04eb38584a fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal
f65c12b395 feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages
8f35234fcc fix(images): name the measured runner blocker; the job container gets no Docker daemon
e539109830 feat(images): build, verify and publish the three images in CI; Renovate carries the digests
27da5555a4 Merge pull request 'fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT' (#80) from fix/renovate-config-filename into main
Compare 7 commits »
gitea-admin commented on pull request Home-Network/home-network-k3s-impl#81 2026-10-30 03:30:11 +00:00
feat(images): build, verify and publish the three images in CI on rootless BuildKit; Renovate carries the digests

CI on 82235dd, read from the job logs:

  • images (run 331): failed as designed. In the real runner it downloaded buildx v0.38.1 and its sha256 check passed. It planned toolbox, agent-runner…
gitea-admin pushed to feat/image-pipeline at Home-Network/home-network-k3s-impl 2026-10-30 03:27:32 +00:00
82235dde30 fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal
310deb0f7d feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages
Compare 2 commits »
da1b36eb64 fix(renovate): pin renovate-version — the action's default (39) rejects renovate.json5
gitea-admin created pull request Home-Network/home-network-k3s-impl#82 2026-10-30 02:49:08 +00:00
fix(keycloak-passkey): passkey reconciler with review fixes — bind only on git's say-so (default false), protect real sub-flows, body-id screening, failure alert
6bb8af1d70 docs(decisions): handoff for the passkey reconciler review fixes
7c4eb439b2 feat(monitoring): alert when the keycloak passkey reconciler's Job fails
17eed6e8ae fix(keycloak-passkey): bind only on git's say-so; protect real sub-flows; screen the requirement PUT by body id
f5931944fa feat(keycloak): reconcile the passkey realm config via GitOps, the browser flow blue/green
Compare 4 commits »
gitea-admin pushed to feat/image-pipeline at Home-Network/home-network-k3s-impl 2026-10-30 02:46:26 +00:00
65a7769f55 fix(images): name the measured runner blocker; the job container gets no Docker daemon
gitea-admin created pull request Home-Network/home-network-k3s-impl#81 2026-10-30 02:36:25 +00:00
feat(images): build, verify and publish the three images in CI; Renovate carries the digests
gitea-admin pushed to feat/image-pipeline at Home-Network/home-network-k3s-impl 2026-10-30 02:35:59 +00:00
0da34ddbc6 feat(images): build, verify and publish the three images in CI; Renovate carries the digests
gitea-admin created branch feat/image-pipeline in Home-Network/home-network-k3s-impl 2026-10-30 02:35:59 +00:00
aacf361bb8 fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT
gitea-admin created branch fix/renovate-config-filename in Home-Network/home-network-k3s-impl 2026-10-30 02:00:11 +00:00
gitea-admin created pull request Home-Network/home-network-k3s-impl#80 2026-10-30 02:00:11 +00:00
fix(renovate): the workflow still named renovate.json, so every run since #79 died with ENOENT