fix: restrict and smoke test container CI

2026-09-19 10:01:23 -04:00
parent b13df3fa34
commit a6f1089120
2 changed files with 31 additions and 6 deletions
@@ -83,8 +83,10 @@ Read-only `tea` inspection on 2026-09-19 reported no Gitea workflows or runs
 for `jb/eden`; runner labels, Docker availability, and action availability are
 therefore not validated. The workflow is prepared locally but has not run
 remotely. The source job runs a strict staging release check after building
-the client, and the separate container job validates Compose expansion and
-builds the digest-pinned web image.
+the client. The separate container job is restricted to trusted pushes,
+validates Compose expansion, builds the digest-pinned web image, compiles a
+synthetic reference into a private volume, and smoke-tests the runtime with
+`--network none`; these steps still need an actual compatible Gitea runner.
 No browser automation, OAuth callback failure injection, Convex migration
 rollback, instance-credential backup/restore, key rotation, or live
 revocation/transfer evidence is claimed by this lane. Those remain explicit