Skip to content

ci: publish pilot images to 508-dev GHCR - #4

Open
michaelmwu wants to merge 2 commits into
mainfrom
publish-508-ghcr-images
Open

ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom
publish-508-ghcr-images

Conversation

@michaelmwu

@michaelmwumichaelmwu commented Aug 28, 2026•
edited by cursor Bot
Loading

Copy link
Copy Markdown
Member

Summary

  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image

Security boundary

  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted

Validation

  • actionlint .github/workflows/publish-images.yml
  • git diff --check

Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.

Note

Medium Risk
Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.

Overview
Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).

Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.

Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.

Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.

@cursor

cursorBot commented Aug 28, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)

@coderabbitai

coderabbitaiBot commented Aug 28, 2026•
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

Next included review available in 31 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2

📥 Commits

Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.

📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot reviewed Aug 28, 2026
View reviewed changes

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:c8b722549b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread.github/workflows/publish-images.yml
@cursor

cursorBot commented Aug 28, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)

@michaelmwumichaelmwu mentioned this pull request Aug 28, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
ci: publish pilot images to 508-dev GHCR by michaelmwu · Pull Request #4 · 508-dev/centaur · GitHub
Skip to content
ci: publish pilot images to 508-dev GHCR - #4
Open
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Open
ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Conversation
@michaelmwu
@michaelmwumichaelmwu
commented
Aug 28, 2026•

edited by cursor
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image
Security boundary
  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted
Validation
  • actionlint .github/workflows/publish-images.yml
  • git diff --check
Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.
Note
Medium Risk

Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.
Overview

Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).
Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.
Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.
Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)
@coderabbitai
coderabbitaiBot
commented
Aug 28, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
Next included review available in 31 minutes.
View limit details
Limit details: You’ve used the included review currently available.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2
📥 Commits
Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.
📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot
reviewed
Aug 28, 2026
View reviewed changes
@chatgpt-codex-connectorchatgpt-codex-connectorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c8b722549b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment thread.github/workflows/publish-images.yml
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)
@michaelmwumichaelmwu
mentioned this pull request
Aug 28, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
ci: publish pilot images to 508-dev GHCR by michaelmwu · Pull Request #4 · 508-dev/centaur · GitHub
Skip to content
ci: publish pilot images to 508-dev GHCR - #4
Open
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Open
ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Conversation
@michaelmwu
@michaelmwumichaelmwu
commented
Aug 28, 2026•

edited by cursor
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image
Security boundary
  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted
Validation
  • actionlint .github/workflows/publish-images.yml
  • git diff --check
Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.
Note
Medium Risk

Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.
Overview

Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).
Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.
Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.
Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)
@coderabbitai
coderabbitaiBot
commented
Aug 28, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
Next included review available in 31 minutes.
View limit details
Limit details: You’ve used the included review currently available.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2
📥 Commits
Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.
📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot
reviewed
Aug 28, 2026
View reviewed changes
@chatgpt-codex-connectorchatgpt-codex-connectorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c8b722549b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment thread.github/workflows/publish-images.yml
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)
@michaelmwumichaelmwu
mentioned this pull request
Aug 28, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
ci: publish pilot images to 508-dev GHCR by michaelmwu · Pull Request #4 · 508-dev/centaur · GitHub
Skip to content
ci: publish pilot images to 508-dev GHCR - #4
Open
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Open
ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Conversation
@michaelmwu
@michaelmwumichaelmwu
commented
Aug 28, 2026•

edited by cursor
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image
Security boundary
  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted
Validation
  • actionlint .github/workflows/publish-images.yml
  • git diff --check
Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.
Note
Medium Risk

Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.
Overview

Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).
Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.
Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.
Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)
@coderabbitai
coderabbitaiBot
commented
Aug 28, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
Next included review available in 31 minutes.
View limit details
Limit details: You’ve used the included review currently available.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2
📥 Commits
Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.
📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot
reviewed
Aug 28, 2026
View reviewed changes
@chatgpt-codex-connectorchatgpt-codex-connectorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c8b722549b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment thread.github/workflows/publish-images.yml
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)
@michaelmwumichaelmwu
mentioned this pull request
Aug 28, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
ci: publish pilot images to 508-dev GHCR by michaelmwu · Pull Request #4 · 508-dev/centaur · GitHub
Skip to content
ci: publish pilot images to 508-dev GHCR - #4
Open
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Open
ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Conversation
@michaelmwu
@michaelmwumichaelmwu
commented
Aug 28, 2026•

edited by cursor
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image
Security boundary
  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted
Validation
  • actionlint .github/workflows/publish-images.yml
  • git diff --check
Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.
Note
Medium Risk

Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.
Overview

Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).
Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.
Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.
Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)
@coderabbitai
coderabbitaiBot
commented
Aug 28, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
Next included review available in 31 minutes.
View limit details
Limit details: You’ve used the included review currently available.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2
📥 Commits
Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.
📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot
reviewed
Aug 28, 2026
View reviewed changes
@chatgpt-codex-connectorchatgpt-codex-connectorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c8b722549b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment thread.github/workflows/publish-images.yml
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)
@michaelmwumichaelmwu
mentioned this pull request
Aug 28, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
ci: publish pilot images to 508-dev GHCR by michaelmwu · Pull Request #4 · 508-dev/centaur · GitHub
Skip to content
ci: publish pilot images to 508-dev GHCR - #4
Open
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Open
ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Conversation
@michaelmwu
@michaelmwumichaelmwu
commented
Aug 28, 2026•

edited by cursor
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image
Security boundary
  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted
Validation
  • actionlint .github/workflows/publish-images.yml
  • git diff --check
Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.
Note
Medium Risk

Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.
Overview

Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).
Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.
Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.
Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)
@coderabbitai
coderabbitaiBot
commented
Aug 28, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
Next included review available in 31 minutes.
View limit details
Limit details: You’ve used the included review currently available.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2
📥 Commits
Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.
📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot
reviewed
Aug 28, 2026
View reviewed changes
@chatgpt-codex-connectorchatgpt-codex-connectorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c8b722549b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment thread.github/workflows/publish-images.yml
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)
@michaelmwumichaelmwu
mentioned this pull request
Aug 28, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
ci: publish pilot images to 508-dev GHCR by michaelmwu · Pull Request #4 · 508-dev/centaur · GitHub
Skip to content
ci: publish pilot images to 508-dev GHCR - #4
Open
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Open
ci: publish pilot images to 508-dev GHCR#4
michaelmwu wants to merge 2 commits into
mainfrom 
publish-508-ghcr-images
Conversation
@michaelmwu
@michaelmwumichaelmwu
commented
Aug 28, 2026•

edited by cursor
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • replace the upstream Depot-only image workflow with GitHub-hosted Buildx jobs
  • validate five pilot images on pull requests without publishing or package-write permission
  • publish immutable commit tags plus main from the default branch only
  • attach provenance and SBOM attestations to each published image
Security boundary
  • the workflow-level token has no permissions
  • PR jobs receive only contents: read
  • only the protected-main publish job receives packages: write
  • checkout credentials are not persisted
Validation
  • actionlint .github/workflows/publish-images.yml
  • git diff --check
Package visibility will remain GHCR's private default on first publish; changing it to public is intentionally a separate operator decision.
Note
Medium Risk

Changes how production images are built and tagged (single-arch, fewer services, no release-tag publishes), which can break deploys that expect the old image set or multi-arch manifests until pipelines are updated.
Overview

Replaces the Depot digest-per-architecture build/merge pipeline with GitHub-hosted Buildx jobs split into validate (PRs) and publish (protected main only).
Validate builds five pilot images (api-rs, discordbot, agent, iron-proxy, console) as linux/amd64 with RUST_BUILD_PROFILE=debug, no push, and GHA layer cache. Publish pushes the same five with release builds, tags main and sha-<commit>, and enables provenance and SBOM; immutable digests are written to the job summary.
Triggers and scope tighten: no v* tag releases, PRs on main with path filters (including patches/** and workflows/**), workflow-level permissions: {}, and packages: write only on publish. Image names use ${{ github.repository_owner }}/centaur instead of a hardcoded namespace. Slack, Linear, GitHub, and Teams bot images are dropped from this workflow; multi-arch arm64 and semver/PR image tags are removed.
Reviewed by Cursor Bugbot for commit 1928c7d. Bugbot is set up for automated code reviews on this repo. Configure here.
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_b3799305-a697-4d10-b739-ca027c117b5e)
@coderabbitai
coderabbitaiBot
commented
Aug 28, 2026•

edited

Loading

Copy link


Copy Markdown

Warning
Review limit reached
Next included review available in 31 minutes.
View limit details
Limit details: You’ve used the included review currently available.
You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.
Learn how review limits work.
Review configuration:
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 84f7c355-2fc9-4844-bce4-dec8886479d2
📥 Commits
Reviewing files that changed from the base of the PR and between 36f340f and 1928c7d.
📒 Files selected for processing (1)
  • .github/workflows/publish-images.yml
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands.
chatgpt-codex-connector[bot]
chatgpt-codex-connectorBot
reviewed
Aug 28, 2026
View reviewed changes
@chatgpt-codex-connectorchatgpt-codex-connectorBot
left a comment


Copy link


Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit:c8b722549b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment thread.github/workflows/publish-images.yml
@cursor
cursorBot
commented
Aug 28, 2026

Copy link


Copy Markdown

Bugbot couldn't run - usage limit reached
Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.
A user or team admin can review and increase usage limits in the Cursor dashboard.
(requestId: serverGenReqId_e72a586c-58c2-4edf-8250-f475b7886a84)
@michaelmwumichaelmwu
mentioned this pull request
Aug 28, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@chatgpt-codex-connectorchatgpt-codex-connector[bot]chatgpt-codex-connector[bot] left review comments

At least 1 approving review is required to merge this pull request.


Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@michaelmwu