SnapOtter

External/SnapOtter

Fork 0

mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00

Files

T

History

SnapOtterandGitHub 44081e6a3f ci(ocr): verify the baked trust file, not unset image env vars (#666 )

Fourth latent bug in the OCR publish chain (#649/#519 added it, never ran).
verify-ocr's trust-identity step read OCR_RUNTIME_INDEX_KEY_ID from the image env,
which the official image leaves unset by design (operator-override path;
runtime-index.ts reads the baked file when env is unset). It compared "" to
snapotter-ocr-2026-07 and failed a correct image. Now verifies the baked
/app/docker/ocr-runtime-trust.json, proven against the built release image.

A full audit of the remaining chain (verify, sign, verify-signed, publish)
reproduced the sign+verify path end-to-end inside the image and confirmed nothing
else breaks for v2.2.0. One latent non-ASCII canonicalization mismatch filed as
#667 (cannot fire on v2.2.0). Non-releasable type so the re-dispatch re-runs 2.2.0.

2026-07-29 20:21:16 +08:00

ai-bundles.yml

ci(ocr): verify the baked trust file, not unset image env vars (#666 )

2026-07-29 20:21:16 +08:00

ci.yml

fix: release QA hardening across processing, media, security, and CI gates (#649 )

2026-07-27 15:37:30 +08:00

cla.yml

test: testing overhaul -- CI e2e gates, parallel suites, generated matrices, mutation testing (#215 )

2026-06-10 22:01:13 +08:00

codeql.yml

chore(deps): bump the actions group with 5 updates (#508 )