- entrypoint.sh: bound the target connectivity check with `-w 2` (the only unbounded step in the startup path)
- tests/entrypoint.bats: widen wait_for_log's budget from 5s to 10s
Merge-triggered runs land on a colder runner (Docker cache evicted by other repos' scheduled jobs since the PR was last tested) than PR-check runs, and the first backgrounded entrypoint.sh in the suite was occasionally landing just past the old 5s window — always passed on rerun once warm.
- release changelog: commits rendered as description (link), divider lines dropped
- gitleaks secret scan and hadolint on every push/PR
- ruff lint/format gate (Python repos) with a pytest --cov-fail-under gate
- scheduled CRITICAL Trivy failures attempt an apk upgrade rebuild and open a follow-up PR if it clears the finding, instead of just failing red
- images also published to ghcr.io/djeex/<repo>
- a matching GitHub Release is created on the GitHub mirror, with a notice pointing back to this repo as the source of truth
Djeex