SnapOtterandGitHub 44081e6a3f ci(ocr): verify the baked trust file, not unset image env vars (#666) ...

Fourth latent bug in the OCR publish chain (#649/#519 added it, never ran).
verify-ocr's trust-identity step read OCR_RUNTIME_INDEX_KEY_ID from the image env,
which the official image leaves unset by design (operator-override path;
runtime-index.ts reads the baked file when env is unset). It compared "" to
snapotter-ocr-2026-07 and failed a correct image. Now verifies the baked
/app/docker/ocr-runtime-trust.json, proven against the built release image.

A full audit of the remaining chain (verify, sign, verify-signed, publish)
reproduced the sign+verify path end-to-end inside the image and confirmed nothing
else breaks for v2.2.0. One latent non-ASCII canonicalization mismatch filed as
#667 (cannot fire on v2.2.0). Non-releasable type so the re-dispatch re-runs 2.2.0.

2026-07-29 20:21:16 +08:00

..

ai-bundles.yml

ci(ocr): verify the baked trust file, not unset image env vars (#666)

2026-07-29 20:21:16 +08:00

ci.yml

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

cla.yml

…

codeql.yml

…

dependency-review.yml

…

deploy-demo.yml

…

deploy-docs.yml

…

deploy-landing.yml

…

dockerhub-description.yml

…

embedded-image.yml

…

labels.yml

…

mutation.yml

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

nightly.yml

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

release.yml

ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665)

2026-07-29 19:05:30 +08:00

star-history.yml

…

update-visual-baselines.yml

…