ci+deploy: pinned build tools, release only from main and tags, backups encrypted
tsk-ngx42j6r0jke open
Hardening, from Oliver 2026-11-04.
- Pin the CLI release build tools with hashes.
- Allow image publishing only from main and tags.
- Encrypt the k3s backup dumps, store them 0600 and keep a copy off the node.
- Pin the Keep the Why skill install instructions to a fixed version.
One rule for image publishing needs a GitHub repo setting by Oliver; the lead arranges it.
Details are in a DM from the lead. Comes after tsk-eejgfehwg4k0. Plan to the lead before the first push.