- build-push.yaml: one job on the x86 runner; amd64 and arm64 (QEMU, continue-on-error) are pushed by digest to Gitea+GHCR, then scripts/assemble-multiarch-index.sh creates :latest/:<version>/:<sha> (same template as coraza-spoa). arm64 failure publishes amd64-only; a stale arm64 digest is never re-attached. Adds workflow_dispatch. - Dockerfile: pin the reviewed UPSTREAM version (HAPROXY_UPSTREAM=3.0.11) via an apt preference so the newest Debian security revision is taken (3.0.11-1+deb13u4 today), and fail the build unless dpkg and `haproxy -v` both report that upstream version. The exact +deb13uN pin froze the image on the superseded u3 and would have hard-failed once u3 left the archive. - The existing build gate (unit suites + haproxy -c) is unchanged and runs for each platform. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
2 lines
10 B
Plaintext
2 lines
10 B
Plaintext
2026.11.3
|