IvanHunters 559c050de0 fix(cozypkg): pin tap short-name to the index version and harden the gate ...

Conformance review against the design proposals surfaced that a short-name tap
ignored the index entry's recorded version: resolveTapTarget returned the bare
ociRef, so 'cozypkg tap <name>' pulled :latest while the CI gate had validated
and cosign-verified <ociRef>:<version>. The gate signed one tag and the cluster
pulled another, breaking both the versioning model (#18) and the signature
chain (#23). Resolve the short name to <ociRef>:<version> when a version is
recorded.

Also harden the publication gate: run 'cozypkg validate --helm-lint' (with helm
installed in the workflow) so charts are linted as the design specifies, and add
a CODEOWNERS so every index entry requires maintainer review.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-09-07 10:58:37 +03:00

..

validate.yaml

fix(cozypkg): pin tap short-name to the index version and harden the gate

2026-09-07 10:58:37 +03:00