Skip to content

Route public releases through isolated nvoip-ci runner - #2

Merged
leandronvoip merged 2 commits into
mainfrom
codex/nvoip-ci-public-release-20260803
Aug 3, 2026
Merged

Route public releases through isolated nvoip-ci runner#2
leandronvoip merged 2 commits into
mainfrom
codex/nvoip-ci-public-release-20260803

Conversation

@leandronvoip

@leandronvoip leandronvoip commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Resumo

  • direciona somente o workflow público de release para o grupo restrito nvoip-ci-public-release
  • executa cada job em um container Podman rootless, efêmero e sem volumes do host
  • mantém o disparo manual seguro com publish=false por padrão

Segurança

O grupo aceita somente os 10 repositórios selecionados e os workflows exatos autorizados. O container recebe apenas o token de registro descartável e os secrets do próprio job; não recebe credenciais AWS, SSH, banco, socket de containers nem worktree do host.

Validação

  • gate pre-pr do Codex: aprovado
  • publicação real: desabilitada no teste manual
  • runner privado nvoip-ci-core: preservado

@leandronvoip leandronvoip changed the title Run public releases on ephemeral Nvoip CI Route public releases through isolated nvoip-ci runner Aug 3, 2026
@leandronvoip
leandronvoip marked this pull request as ready for review August 3, 2026 19:45
@leandronvoip
leandronvoip merged commit c877bb2 into main Aug 3, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant