M5: publish seam + CI/CD pipeline

scripts/new-post.mjs writes schema-valid posts from flags or a JSON event (the IaC publish seam). Gitea Actions workflow: ci check, audit-ci gate, build, dist scan, CycloneDX SBOM, buildah build+push, and a least-privilege digest-bump PR to home-ops (never auto-merged). Renovate + audit allowlist.
2026-06-17 17:20:54 +10:00
parent c1db5cec86
commit 83edaf5975
10 changed files with 2503 additions and 4 deletions
@@ -23,7 +23,9 @@
  },
  "devDependencies": {
    "@astrojs/check": "^0.9.9",
+    "@cyclonedx/cyclonedx-npm": "^5.0.0",
    "@types/node": "^25.9.3",
+    "audit-ci": "^7.1.0",
    "typescript": "^6.0.3"
  }
 }