Repository navigation
Publish community StackPacks individually on Quay - #44
Merged
Merged
Conversation
Move the three product-maintained packs out of the contrib catalog after the separate core bundle and chart adoption are ready. This branch only prepares the removal; the product continues to consume main until those dependencies are verified. Validate and package contributions without publishing credentials, gate both architecture images, then publish immutable per-pack GHCR tags from trusted main pushes. Document ownership, CLI upload, optional chart images and first-package public visibility. Reuse scanned artifacts for signed publication. Validation: online Zizmor 1.31.1, actionlint 1.7.12, shell syntax, empty discovery, and a temporary valid community package exercised the workflow packaging and both architecture image-content checks. Both control images passed separate Trivy secret and HIGH/CRITICAL vulnerability scans; the sample passed the pinned platform validator. Tracking: StackVista/stackstate#892
Resolve the upstream action-pin conflicts by adopting image-pipeline v1.0.1 while preserving the per-pack GHCR publication flow.
Keep the existing public contrib repository and dedicated Quay credentials. Prefix package versions with the StackPack name so each opt-in image contains one independently versioned integration. Remove GHCR package permission and visibility setup. Serialize publisher matrix jobs because scan-sign-push temporary signature handles use the workflow run ID, shared across all matrix entries in this Quay repository. Packaging and image validation remain parallel. Validated actionlint, ShellCheck, online Zizmor and disposable release planning controls for distinct packs, prereleases, immutable existing versions, registry authorization errors and tag length.
aacevedoosorio
changed the title
aacevedoosorio
marked this pull request as ready for review
November 6, 2026 13:55
LouisLotter
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishes each community StackPack as an opt-in image at
quay.io/stackstate/contrib-stackpacks:<name>-<version>, using the existing contrib publisher credentials. Updates contribution and installation instructions and removes the three product packs migrated to core.Merge after product delivery and default core adoption are verified. Publication is serialized because the signing action shares temporary tags within this repository.
Validation: workflow security, actionlint, shell checks and release-tag controls pass. Native CI passes; publication skips because the community catalog is empty.
Tracking: https://github.com/StackVista/stackstate/issues/892