Rename the service to atomic-update-ca-trust, remove the legacy extract argument, and defer crypto-policy regeneration. Document early-boot and initramfs limitations and keep regeneration failures visible without preventing boot.
Add standard-image regression coverage for stale bundles, vendor CA changes, local trust and distrust, repeated refreshes, and service activation.
- Allow the shell executor for post-upgrade commands so
pipeline-migration-tool can expand $RENOVATE_POST_UPGRADE_COMMAND_DATA_FILE,
and match MintMaker's execution timeout.
- Set ignorePrAuthor so on-demand runs see and update the bot's MRs.
- Disable the Dependency Dashboard for on-demand runs, since Renovate
only finds dashboards created by the token's user and would otherwise
create a duplicate.
Document the Commit Status: Create token permission (needed for branch
statuses) and MR ownership caveats in CONTRIBUTING.md.
Signed-off-by: John Eckersberg <dev@eckersberg.com>
Renovate runs via Konflux MintMaker on a fixed cluster-wide schedule
and cannot be triggered early from this repository. Add a `just renovate`
target that runs the MintMaker Renovate image with MintMaker's global
configuration against GitLab, with schedules overridden, so updates can
be regenerated on demand. `--dry-run` previews without pushing.
Document fine-grained GitLab token setup in CONTRIBUTING.md.
Signed-off-by: John Eckersberg <dev@eckersberg.com>
Add optional rechunker and chunked stages that use chunkah for
content-based layer splitting. This allows folding the splitting step
into the build step.
Through some build arg and redirection trickery, this leaves the
unchunked path functionally identical.
Assisted-by: OpenCode (Claude Opus 4.6)
Following the bootc-dev repository-structure.md guidelines, add a Justfile
as the development entry point so CI flows are easily replicable locally.
The CI now invokes 'just <target>' instead of inline build commands.
Configuration is via environment variables:
TIER - content tier (standard, minimal, minimal-plus, iot)
FEDORA_VERSION - target Fedora release (rawhide, 43, 44, ...)
BUILDER - container build tool (buildah, podman)
CI tests each tier against both rawhide and Fedora 44, and smoke-tests
Fedora 43 with a standard build.
Assisted-by: OpenCode (Claude Opus 4)
