IvanHunters 11e2f07fae feat(packages-index): add community index gate template with two-lane merge ...

Add a template for the standalone cozystack/packages-index repository: the
metadata-only entry format (with a version and a recorded cosign signing
identity), an example entry, and the publication gate. The gate script
validates every changed entry with 'cozypkg validate --require-signature'
against the entry's recorded identity and classifies the change into the
auto-merge lane (a pure version bump of an already-listed entry) or the
maintainer-review lane (a new entry or a change to ociRef, maintainer, or
signing). It fails closed: a validation error, a parse error, a signature
failure, or a security-relevant edit never auto-merges. A companion GitHub
Actions workflow runs the gate and enables auto-merge or requests review
accordingly. Add a version field to the index entry so a bump is detectable.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-09-07 10:58:36 +03:00

..

example.foo.yaml

feat(packages-index): add community index gate template with two-lane merge

2026-09-07 10:58:36 +03:00