[pull] stable-f44 from main

.github/setup-runner-keys.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Setup Public Keys for containers that are pulled during the build
+
+set -eoux pipefail
+
+PKI_DIR="/etc/pki/containers"
+REGISTRIES="/etc/containers/registries.d"
+
+mkdir -p "${PKI_DIR}" "${REGISTRIES}"
+cp cosign.pub "${PKI_DIR}/ghcr.io-ublue-os.pub"
+cp quay.io-fedora-ostree-desktops.pub "${PKI_DIR}"
+
+yq -n '.docker."ghcr.io/ublue-os".use-sigstore-attachments = true' | tee "${REGISTRIES}"/ublue-os.yaml
+yq -n '.docker."quay.io/fedora-ostree-desktops".use-sigstore-attachments = true' | tee "${REGISTRIES}"/fedora-ostree-desktops.yaml
+
+jq '.transports.docker["ghcr.io/ublue-os"] = [
+  {
+    "type": "sigstoreSigned",
+    "keyPath": "/etc/pki/containers/ghcr.io-ublue-os.pub",
+    "signedIdentity": {
+      "type": "matchRepository"
+    }
+  }
+] |
+.transports.docker["quay.io/fedora-ostree-desktops"] = [
+  {
+    "type": "sigstoreSigned",
+    "keyPath": "/etc/pki/containers/quay.io-fedora-ostree-desktops.pub",
+    "signedIdentity": {
+      "type": "matchRepository"
+    }
+  }
+]' /etc/containers/policy.json | tee /etc/containers/policy.json.tmp > /dev/null && mv /etc/containers/policy.json.tmp /etc/containers/policy.json

.github/workflows/build-image-latest-main.yml

@@ -20,18 +20,20 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-  attestations: write
-  artifact-metadata: write
+permissions: {}
 
 jobs:
   build-image-latest:
     name: Build Latest Images
     uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    secrets:
+      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
     strategy:
       fail-fast: false
       matrix:
@@ -51,7 +53,6 @@ jobs:
     needs: [build-image-latest]
     permissions:
       contents: write
-    secrets: inherit
     uses: ./.github/workflows/generate-release.yml
     with:
       stream_name: '["latest"]'

.github/workflows/build-image-stable.yml

@@ -14,18 +14,20 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-  attestations: write
-  artifact-metadata: write
+permissions: {}
 
 jobs:
   build-image-stable:
     name: Build Stable Images
     uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    secrets:
+      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
     strategy:
       fail-fast: false
       matrix:
@@ -43,7 +45,6 @@ jobs:
     needs: [build-image-stable]
     permissions:
       contents: write
-    secrets: inherit
     uses: ./.github/workflows/generate-release.yml
     with:
       stream_name: '["stable"]'

.github/workflows/build-image-testing.yml

@@ -11,18 +11,20 @@ on:
    workflow_call:
    workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-  attestations: write
-  artifact-metadata: write
+permissions: {}
 
 jobs:
   build-image-testing:
     name: Build Testing Images
     uses: ./.github/workflows/reusable-build.yml
-    secrets: inherit
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    secrets:
+      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/cherry-pick-to-stable.yml

@@ -26,8 +26,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
+          persist-credentials: false
           # Use the dynamically generated GitHub App token
           token: ${{ steps.generate-token.outputs.token }}
+          # Explicitly check out the base branch (the PR is already merged into it).
+          # Avoids the default `refs/pull/<PR>/merge` ref, which actions/checkout
+          # refuses to check out for fork PRs on pull_request_target events.
+          ref: ${{ github.event.pull_request.base.ref }}
           fetch-depth: 0
 
       - name: Configure Git Author

.github/workflows/clean.yml

@@ -24,3 +24,11 @@ jobs:
           delete-orphaned-images: true
           keep-n-tagged: 7
           keep-n-untagged: 7
+
+      - name: Delete All OCI Artifact Cache
+        uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          packages: aurora/cache/dnf
+          keep-n-tagged: 1
+          older-than: 90 days

.github/workflows/generate-release.yml

@@ -33,6 +33,7 @@ jobs:
       - name: Checkout last 500 commits (for <commits> to work)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
+          persist-credentials: false
           fetch-depth: 500
           ref: stable-f44
 
@@ -47,23 +48,29 @@ jobs:
           just check
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
 
       - name: Generate Release Text
         id: generate-release-text
+        env:
+          MATRIX_VERSION: "${{ matrix.version }}"
+          HANDWRITTEN: "${{ inputs.handwritten }}"
         shell: bash
         run: |
-          just changelogs "${{ matrix.version }}" "${{ inputs.handwritten }}"
+          just changelogs "${MATRIX_VERSION}" "${HANDWRITTEN}"
           source ./output.env
           echo "title=${TITLE}" >> $GITHUB_OUTPUT
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         if: contains(fromJson('["stable"]'), matrix.version) && (github.event.schedule == '0 1 * * TUE' || contains(fromJson('["workflow_dispatch", "workflow_call"]'), github.event_name))
-        with:
-          name: ${{ steps.generate-release-text.outputs.title }}
-          tag_name: ${{ steps.generate-release-text.outputs.tag }}
-          body_path: ./changelog.md
-          make_latest: ${{ matrix.version == 'stable' }}
-          prerelease: false
+        env:
+          TITLE: ${{ steps.generate-release-text.outputs.title }}
+          TAG: ${{ steps.generate-release-text.outputs.tag }}
+          BODY_PATH: ./changelog.md
+        run: |
+          gh release create \
+          "${TAG}" \
+          --title "${TITLE}" \
+          -F "${BODY_PATH}" \
+          --latest

.github/workflows/moderator.yml

@@ -19,6 +19,9 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
       - uses: github/ai-moderator@81159c370785e295c97461ade67d7c33576e9319 # v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}