[Baylem]

Closes #877. Part of #867.

The release workflow verifies the published chart and component image signatures and digests using a fresh consumer identity. It checks runtime image IDs on a clean install and exercises a populated upgrade from the previously supported release with the existing data-retention fixture.

#917 has merged into master. The integration branch stack/877-gitops-and-browser-ci combines its browser setup with the populated GitOps upgrade fixture from #901. Merge #901 before this PR, then retarget #906 to master and recheck the release-only diff.

After #866 merged, upstream moved the v0.4.0 tag to 46b719f6da280ba5f1b42a6aa21ef2d2db35d683 and published the release at 15:48 UTC on November 11. GitHub marks the published release immutable. Moving the pre-publication tag is a recorded exception to the original tag-preservation request. Both source commits and publisher runs remain independently identifiable. The read-only consumer was dispatched against the corrected artifacts from #906 at 1504f079. Successful publisher · Published release · Consumer run

Commits 7e745127 and 1504f079 verify the signed repository, manifest digest, source commit and version. The consumer also isolates the two Kind clusters, installs the previous chart by its verified digest and verifies the prior running components before the upgrade. Anonymous registry checks verified all 12 historical v0.3.0 image signatures and 24 configurations. Historical digests and qualifying release procedure

Published v0.4.0 consumer passed. An anonymous consumer verified the signed chart ghcr.io/gameplanepanel/charts/gameplane@sha256:fda83c36ce540b81e3c9641037e542ab8e6ac9270fe560396e34c9300bcaf12c, all 12 published component indexes, and 24 linux/amd64 and linux/arm64 configurations against 46b719f6. Fresh amd64 installation and upgrade from the signed v0.3.0 release both succeeded. The running API, operator and web image IDs matched the signed indexes. The upgraded game agent matched its signed index too. The populated upgrade took 29.55 seconds and verified the same game data PVC UID, original world marker and pre-existing user login. The test compares the UID directly and prints it only on failure. Consumer job and digests · Retention assertions

The release-only dispatch passed on the previous head 685603d0 with one consumer job and 36 ordinary jobs skipped. Its live v0.3.0 to v0.4.0 populated upgrade took 34.73 seconds and matched the signed runtime image IDs before and after the upgrade. Dispatching without a tag still requests the full ordinary suite. Release consumer and recorded runtime digests · Ordinary PR checks

After the final screenshot workflow from #917 entered the integration base, the release patch remained identical. On 48887be2, the anonymous v0.4.0 consumer passed again with one executed job and 36 expected skips. The populated v0.3.0 upgrade took 39.92 seconds and confirmed the same PVC UID, world marker, prior user login and signed image IDs. Final release qualification and runtime digests · Ordinary PR CI passed with 110 successes and one expected skip

Current head ddba490b targets c37041c6, which incorporates master 8ca4f1b5 and the current RBAC prerequisite. The 12-file release verification patch is unchanged. The anonymous signed v0.4.0 consumer passed on a fresh Kind cluster. Its populated v0.3.0 to v0.4.0 upgrade took 31.74 seconds, retained the game PVC UID, world marker and previous login, and verified the runtime image IDs. The ordinary PR matrix finished with 110 successful jobs and one expected skip, including live upgrades on both architectures. Published release consumer and runtime digests · Full PR CI report

[coderabbitai]

Pre-merge checks: 1 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Title check		This assessment has not completed. The check will be retried on the next pre-merge check run.

Passed checks: 1 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

CI Report - ddba490

run 43139708875 - attempt 1

0 failed - 33 passed - 0 skipped - 170m18s elapsed

Test selection: full (selection-rule change) - per-suite table

Coverage

Module	Measured	Gate	Margin
web	L94.03 S92.14 B86.51 F90.19	L92 S92 B82 F76	+0.14

Changed

Area	Files	+/-
deploy/	4	+238/-23
test/	3	+205/-56
.github/	3	+69/-4
docs/	1	+20/-0
changelog/	1	+5/-0

Slowest jobs

Job	Duration
e2e telemetry / arm64 (kind)	22m46s
build e2e images	17m18s
e2e restricted-workloads / arm64 (kind)	15m15s
e2e capture overhead (kind)	13m38s
e2e operator / amd64 (kind)	12m59s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, monitoring, multicluster, network-isolation, operator, optional-components, postgres-availability, ratelimit, restricted-workloads, telemetry, upgrade, wake-hostport

[ValgulNecron]

Hey, could you please add changelog entry?

[Baylem]

Added the requested unreleased changelog entry.

CI passed on 48887be2. The diff through fd02628b changes only the changelog entry and its index link. I canceled the repeat CI run because this update changes only Markdown.