ed0e835863a0eeed0227534a9f88916785127322
All checks were successful
addon-qualify / qualify (push) Successful in 12s
Adds cosign install + sign-blob step before commit. The detached .sig (base64-encoded ASN.1 DER ECDSA over SHA256(file)) is committed alongside seeded-ci.json. Tower's loader verifies it pure-Go before replay; mismatched/missing sig → refuse + log. cosign.pub is also checked in so the workflow can self-verify before push (catches key-rotation mismatch early). The same pubkey is embedded in Tower's binary at compat_bootstrap_pubkey.pem; both copies must match or replay will fail.
odoo-addons
Public addon source-of-truth. One branch per Odoo major (14.0-19.0). Layout: addons//. Tags: /. Builds happen inside each customer cluster on demand.
Description
Public addon source-of-truth. One branch per Odoo major (14.0-19.0). Layout: addons/
/. Tags: /. Builds happen inside each customer cluster on demand.