- build-push.yaml: one job on the x86 runner; amd64 and arm64 (QEMU,
continue-on-error) are pushed by digest to Gitea+GHCR, then
scripts/assemble-multiarch-index.sh creates :latest/:<version>/:<sha>
(same template as coraza-spoa). arm64 failure publishes amd64-only; a
stale arm64 digest is never re-attached. Adds workflow_dispatch.
- Dockerfile: pin the reviewed UPSTREAM version (HAPROXY_UPSTREAM=3.0.11) via
an apt preference so the newest Debian security revision is taken
(3.0.11-1+deb13u4 today), and fail the build unless dpkg and `haproxy -v`
both report that upstream version. The exact +deb13uN pin froze the image
on the superseded u3 and would have hard-failed once u3 left the archive.
- The existing build gate (unit suites + haproxy -c) is unchanged and runs
for each platform.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
shadowdaoandClaude Sonnet 5.5