@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/18-frontend-lane.yml.ejs

@@ -0,0 +1,50 @@
+<%
+const _cm = (typeof collaborationMode !== 'undefined' ? collaborationMode : 'peer-review');
+const _runner = (_cm === 'gated-review' && isL3Plus)
+  ? "${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}"
+  : "${{ fromJSON(vars.RUNNER_LABELS_TEST || '[\"ubuntu-latest\"]') }}";
+%>name: Frontend Lane Gate (T1)
+
+# #1330 — per-lane frontend gate for a `frontend/` SUBTREE in a polyglot repo.
+# Runs the FE lane's own typecheck/test/build (the primary-language CI gate covers
+# only the backend). Path-scoped so it fires only on frontend/ subtree changes.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'frontend/**'
+      - 'scripts/check-frontend-lane.mjs'
+  push:
+    branches: [main]
+    paths:
+      - 'frontend/**'
+      - 'scripts/check-frontend-lane.mjs'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: frontend-lane-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  frontend-lane:
+    name: Frontend lane gate (typecheck, test, build)
+    runs-on: <%- _runner %>
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+          package-manager-cache: false
+
+      - name: Install frontend subtree deps
+        run: npm ci --prefix frontend
+
+      - name: Run frontend lane gate (full)
+        run: node scripts/check-frontend-lane.mjs full

package/dist/templates/github/workflows/_ai-draft-check.yml.ejs

@@ -0,0 +1,44 @@
+name: AI-draft PR check (bot)
+
+# INV-91: AI-PR human-approval gate.
+# Bot-authored PRs must have the approved-by-human label before merge.
+# Triggers on label changes so re-labeling turns the check green immediately.
+# dependabot[bot] is exempt: dependency-bump PRs are low-risk boilerplate and
+# nobody applies the approved-by-human label to them, so the gate was pure
+# noise on every dependabot PR. Other bot authors (AI agents) are unaffected —
+# INV-91 semantics stay intact for them.
+# Generated by arbiter (#884).
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+
+# Only the latest label state matters — supersede older in-flight runs per PR.
+concurrency:
+  group: ai-draft-check-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  ai-draft-check:
+    name: AI-PR human-approval check (INV-91)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    if: github.event.pull_request.user.type == 'Bot' && github.event.pull_request.user.login != 'dependabot[bot]'
+    steps:
+      - name: Assert approved-by-human label on bot-authored PR
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b  # v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const labels = context.payload.pull_request.labels.map(l => l.name);
+            if (!labels.includes('approved-by-human')) {
+              core.setFailed(
+                'Bot-authored PR requires the "approved-by-human" label before merge. ' +
+                'A human reviewer must approve the PR. ' +
+                'See docs/REFERENCE/ai-pr-gate.md (INV-91).'
+              );
+            } else {
+              core.info('approved-by-human label present — AI-PR gate passes.');
+            }

package/dist/templates/github/workflows/_contract-postman.yml.ejs

@@ -0,0 +1,93 @@
+name: Contract Tests — Postman/Newman
+
+permissions:
+  contents: read
+  checks: write
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'postman/**'
+      - 'pacts/**'
+      - 'scripts/run-postman-tests.sh'
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: 'Service base URL to test against'
+        required: false
+        default: 'http://localhost:8080'
+
+# Cancel in-progress contract runs on the same branch — re-runs on each push.
+concurrency:
+  group: contract-postman-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  contract-postman:
+    name: Postman/Newman Contract Tests (INV-35)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+
+<%  if (language === 'java' || language === 'multi') { %>
+    services:
+      app:
+        image: ${{ vars.APP_IMAGE || format('ghcr.io/{0}:pr-{1}', github.repository, github.event.pull_request.number) }}
+        ports:
+          - 8080:8080
+        env:
+          SPRING_PROFILES_ACTIVE: contract-test
+<%  } %>
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Setup Node.js (for Newman)
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version-file: '.nvmrc'
+          package-manager-cache: false
+
+      - name: Install Newman
+        run: npm install -g newman newman-reporter-junitfull
+
+      - name: Prepare results directory
+        run: mkdir -p .arbiter/evidence/contract
+
+      - name: Inject Pact samples (optional)
+        env:
+          SERVICE_BASE_URL: ${{ github.event.inputs.base_url || 'http://localhost:8080' }}
+          PACTS_DIR: pacts
+        run: |
+          if [[ -d pacts ]] && ls pacts/*.json &>/dev/null; then
+            bash scripts/inject-pact-samples.sh
+          else
+            echo "No pacts directory — skipping sample injection."
+          fi
+
+      - name: Run Newman contract tests
+        env:
+          SERVICE_BASE_URL: ${{ github.event.inputs.base_url || 'http://localhost:8080' }}
+          POSTMAN_COLLECTION: ${{ vars.POSTMAN_COLLECTION || 'postman/<%= projectName ? projectName.replace(/[^a-z0-9_-]/gi, "-").toLowerCase() : "api" %>.postman_collection.json' }}
+          RESULTS_DIR: .arbiter/evidence/contract
+          NEWMAN_TIMEOUT_MS: '30000'
+          NEWMAN_MAX_RETRIES: '1'
+        run: bash scripts/run-postman-tests.sh
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: newman-results-${{ github.run_id }}
+          path: .arbiter/evidence/contract/newman-results.xml
+          if-no-files-found: warn
+
+      - name: Publish JUnit results
+        if: always()
+        uses: mikepenz/action-junit-report@3585f732c9e1f2c1b7a7c99b27ddd7b85082c04d # v5.2.0
+        with:
+          report_paths: '.arbiter/evidence/contract/newman-results.xml'
+          check_name: 'Postman/Newman Contract Tests'
+          fail_on_failure: true

package/dist/templates/github/workflows/_cosign-copy/aws-ecs.ejs

@@ -0,0 +1,90 @@
+      - name: Install cosign (keyless OIDC)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502  # v4
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION || 'us-east-1' }}
+
+      - name: ECR login (TEST + PROD registries)
+        env:
+          ECR_TEST_REGISTRY: ${{ vars.ECR_TEST_REGISTRY }}
+          ECR_PROD_REGISTRY: ${{ vars.ECR_PROD_REGISTRY }}
+        run: |
+          set -euo pipefail
+          if grep -qi 'PLACEHOLDER-' <<< "${ECR_TEST_REGISTRY:-PLACEHOLDER-unset}"; then
+            echo "::error::ECR_TEST_REGISTRY contains PLACEHOLDER- — configure the variable before enabling deploy"
+            exit 1
+          fi
+          if grep -qi 'PLACEHOLDER-' <<< "${ECR_PROD_REGISTRY:-PLACEHOLDER-unset}"; then
+            echo "::error::ECR_PROD_REGISTRY contains PLACEHOLDER- — configure the variable before enabling deploy"
+            exit 1
+          fi
+          # Login to both registries (may be in same or different accounts/regions)
+          aws ecr get-login-password --region "${AWS_DEFAULT_REGION}" \
+            | docker login --username AWS --password-stdin "${ECR_TEST_REGISTRY}"
+          aws ecr get-login-password --region "${AWS_DEFAULT_REGION}" \
+            | docker login --username AWS --password-stdin "${ECR_PROD_REGISTRY}"
+
+      - name: Resolve IMAGE_SHA from TEST ECR
+        id: resolve-sha
+        env:
+          ECR_TEST_REGISTRY: ${{ vars.ECR_TEST_REGISTRY }}
+          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          IMAGE_SHA=$(aws ecr describe-images \
+            --repository-name "${ECR_REPOSITORY}" \
+            --image-ids imageTag="${RELEASE_TAG}" \
+            --query 'imageDetails[0].imageDigest' --output text 2>/dev/null || echo "")
+          if [ -z "${IMAGE_SHA}" ] || [ "${IMAGE_SHA}" = "None" ]; then
+            echo "::error::Could not resolve digest for ${ECR_TEST_REGISTRY}/${ECR_REPOSITORY}:${RELEASE_TAG}. Ensure the image was published by the TEST deploy workflow."
+            exit 1
+          fi
+          echo "IMAGE_SHA=${IMAGE_SHA}" >> "$GITHUB_ENV"
+          echo "digest=${IMAGE_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: cosign copy TEST ECR → PROD ECR
+        # cosign copy required — docker/crane tag drops OCI referrers (signatures, SBOM)
+        env:
+          ECR_TEST_REGISTRY: ${{ vars.ECR_TEST_REGISTRY }}
+          ECR_PROD_REGISTRY: ${{ vars.ECR_PROD_REGISTRY }}
+          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          cosign copy \
+            "${ECR_TEST_REGISTRY}/${ECR_REPOSITORY}@${IMAGE_SHA}" \
+            "${ECR_PROD_REGISTRY}/${ECR_REPOSITORY}:${RELEASE_TAG}"
+
+      - name: Resolve PROD digest (pin for verify + deploy)
+        env:
+          ECR_PROD_REGISTRY: ${{ vars.ECR_PROD_REGISTRY }}
+          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          DEST_DIGEST=$(aws ecr describe-images \
+            --repository-name "${ECR_REPOSITORY}" \
+            --image-ids imageTag="${RELEASE_TAG}" \
+            --query 'imageDetails[0].imageDigest' --output text)
+          if [ -z "${DEST_DIGEST}" ] || [ "${DEST_DIGEST}" = "None" ]; then
+            echo "::error::Could not resolve PROD digest after cosign copy"
+            exit 1
+          fi
+          # Export pinned ref: deploy partial uses IMAGE_TAG from $GITHUB_ENV (avoids TOCTOU on mutable tag)
+          echo "IMAGE_TAG=${ECR_PROD_REGISTRY}/${ECR_REPOSITORY}@${DEST_DIGEST}" >> "$GITHUB_ENV"
+          echo "DEST_DIGEST=${DEST_DIGEST}" >> "$GITHUB_ENV"
+
+      - name: cosign verify PROD image (ECR)
+        env:
+          ECR_PROD_REGISTRY: ${{ vars.ECR_PROD_REGISTRY }}
+          ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY || 'app' }}
+        run: |
+          set -euo pipefail
+          cosign verify \
+            --certificate-identity-regexp 'https://github\.com/<%= githubOwner %>/<%= githubRepo %>/.github/workflows/05-release\.yml@refs/tags/v.*' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${ECR_PROD_REGISTRY}/${ECR_REPOSITORY}@${DEST_DIGEST}"

package/dist/templates/github/workflows/_cosign-copy/azure-container-app.ejs

@@ -0,0 +1,97 @@
+      - name: Install cosign (keyless OIDC)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+      - name: Azure login
+        uses: azure/login@a457da9ea143d694b1fa9c8f8b1b5ab5a6ab08be  # v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: ACR login (TEST — read source image)
+        env:
+          ACR_TEST_LOGIN_SERVER: ${{ vars.ACR_TEST_LOGIN_SERVER }}
+        run: |
+          set -euo pipefail
+          if grep -qi 'PLACEHOLDER-' <<< "${ACR_TEST_LOGIN_SERVER:-PLACEHOLDER-unset}"; then
+            echo "::error::ACR_TEST_LOGIN_SERVER contains PLACEHOLDER- — configure the variable before enabling deploy"
+            exit 1
+          fi
+          az acr login --name "${ACR_TEST_LOGIN_SERVER%%.*}"
+
+      - name: Resolve IMAGE_SHA from TEST ACR
+        id: resolve-sha
+        env:
+          ACR_TEST_LOGIN_SERVER: ${{ vars.ACR_TEST_LOGIN_SERVER }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          IMAGE_SHA=$(az acr manifest list-metadata \
+            --registry "${ACR_TEST_LOGIN_SERVER%%.*}" \
+            --name "${IMAGE_NAME}" \
+            --query "[?contains(tags, '${RELEASE_TAG}')].digest | [0]" -o tsv) || {
+            echo "::error::Could not resolve digest for ${ACR_TEST_LOGIN_SERVER}/${IMAGE_NAME}:${RELEASE_TAG}. Ensure the image was published by the TEST deploy workflow."
+            exit 1
+          }
+          if [ -z "${IMAGE_SHA}" ]; then
+            echo "::error::Digest is empty for ${ACR_TEST_LOGIN_SERVER}/${IMAGE_NAME}:${RELEASE_TAG}"
+            exit 1
+          fi
+          echo "IMAGE_SHA=${IMAGE_SHA}" >> "$GITHUB_ENV"
+          echo "digest=${IMAGE_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: ACR login (PROD — push destination)
+        env:
+          ACR_PROD_LOGIN_SERVER: ${{ vars.ACR_PROD_LOGIN_SERVER }}
+        run: |
+          set -euo pipefail
+          if grep -qi 'PLACEHOLDER-' <<< "${ACR_PROD_LOGIN_SERVER:-PLACEHOLDER-unset}"; then
+            echo "::error::ACR_PROD_LOGIN_SERVER contains PLACEHOLDER- — configure the variable before enabling deploy"
+            exit 1
+          fi
+          az acr login --name "${ACR_PROD_LOGIN_SERVER%%.*}"
+
+      - name: cosign copy TEST ACR → PROD ACR
+        # cosign copy required — docker/crane tag drops OCI referrers (signatures, SBOM)
+        env:
+          ACR_TEST_LOGIN_SERVER: ${{ vars.ACR_TEST_LOGIN_SERVER }}
+          ACR_PROD_LOGIN_SERVER: ${{ vars.ACR_PROD_LOGIN_SERVER }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          cosign copy \
+            "${ACR_TEST_LOGIN_SERVER}/${IMAGE_NAME}@${IMAGE_SHA}" \
+            "${ACR_PROD_LOGIN_SERVER}/${IMAGE_NAME}:${RELEASE_TAG}"
+
+      - name: Resolve PROD digest (pin for verify + deploy)
+        env:
+          ACR_PROD_LOGIN_SERVER: ${{ vars.ACR_PROD_LOGIN_SERVER }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          DEST_DIGEST=$(az acr manifest list-metadata \
+            --registry "${ACR_PROD_LOGIN_SERVER%%.*}" \
+            --name "${IMAGE_NAME}" \
+            --query "[?contains(tags, '${RELEASE_TAG}')].digest | [0]" -o tsv) || {
+            echo "::error::Could not resolve PROD digest after cosign copy"
+            exit 1
+          }
+          if [ -z "${DEST_DIGEST}" ]; then
+            echo "::error::PROD digest is empty after cosign copy"
+            exit 1
+          fi
+          # Export pinned ref: deploy partial uses IMAGE_TAG from $GITHUB_ENV (avoids TOCTOU on mutable tag)
+          echo "IMAGE_TAG=${ACR_PROD_LOGIN_SERVER}/${IMAGE_NAME}@${DEST_DIGEST}" >> "$GITHUB_ENV"
+          echo "DEST_DIGEST=${DEST_DIGEST}" >> "$GITHUB_ENV"
+
+      - name: cosign verify PROD image (ACR)
+        env:
+          ACR_PROD_LOGIN_SERVER: ${{ vars.ACR_PROD_LOGIN_SERVER }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          set -euo pipefail
+          cosign verify \
+            --certificate-identity-regexp 'https://github\.com/<%= githubOwner %>/<%= githubRepo %>/.github/workflows/05-release\.yml@refs/tags/v.*' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${ACR_PROD_LOGIN_SERVER}/${IMAGE_NAME}@${DEST_DIGEST}"

package/dist/templates/github/workflows/_cosign-copy/gcp-cloud-run.ejs

@@ -0,0 +1,102 @@
+      - name: Install cosign (keyless OIDC)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+      - name: Google auth (Workload Identity Federation)
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed  # v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
+
+      - name: Configure Docker for GAR (TEST + PROD locations)
+        env:
+          GAR_TEST_LOCATION: ${{ vars.GAR_TEST_LOCATION }}
+          GAR_PROD_LOCATION: ${{ vars.GAR_PROD_LOCATION }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+        run: |
+          set -euo pipefail
+          for VAR in GAR_TEST_LOCATION GAR_PROD_LOCATION GCP_PROJECT_ID; do
+            VALUE="${!VAR:-PLACEHOLDER-unset}"
+            if grep -qi 'PLACEHOLDER-' <<< "${VALUE}"; then
+              echo "::error::${VAR} contains PLACEHOLDER- — configure the variable before enabling deploy"
+              exit 1
+            fi
+          done
+          gcloud auth configure-docker "${GAR_TEST_LOCATION}-docker.pkg.dev" --quiet
+          gcloud auth configure-docker "${GAR_PROD_LOCATION}-docker.pkg.dev" --quiet
+
+      - name: Resolve IMAGE_SHA from TEST GAR
+        id: resolve-sha
+        env:
+          GAR_TEST_LOCATION: ${{ vars.GAR_TEST_LOCATION }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+          GAR_TEST_REPOSITORY: ${{ vars.GAR_TEST_REPOSITORY || 'app' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          TEST_IMAGE="${GAR_TEST_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_TEST_REPOSITORY}/${IMAGE_NAME}:${RELEASE_TAG}"
+          # gcloud artifacts docker images describe is the correct command for Artifact Registry
+          IMAGE_SHA=$(gcloud artifacts docker images describe "${TEST_IMAGE}" \
+            --format 'value(image_summary.digest)') || {
+            echo "::error::Could not resolve digest for ${TEST_IMAGE}. Ensure the image was published by the TEST deploy workflow."
+            exit 1
+          }
+          if [ -z "${IMAGE_SHA}" ]; then
+            echo "::error::Digest is empty for ${TEST_IMAGE}"
+            exit 1
+          fi
+          echo "IMAGE_SHA=${IMAGE_SHA}" >> "$GITHUB_ENV"
+          echo "digest=${IMAGE_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: cosign copy TEST GAR → PROD GAR
+        # cosign copy required — docker/crane tag drops OCI referrers (signatures, SBOM)
+        env:
+          GAR_TEST_LOCATION: ${{ vars.GAR_TEST_LOCATION }}
+          GAR_PROD_LOCATION: ${{ vars.GAR_PROD_LOCATION }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+          GAR_TEST_REPOSITORY: ${{ vars.GAR_TEST_REPOSITORY || 'app' }}
+          GAR_PROD_REPOSITORY: ${{ vars.GAR_PROD_REPOSITORY || 'app' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          cosign copy \
+            "${GAR_TEST_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_TEST_REPOSITORY}/${IMAGE_NAME}@${IMAGE_SHA}" \
+            "${GAR_PROD_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_PROD_REPOSITORY}/${IMAGE_NAME}:${RELEASE_TAG}"
+
+      - name: Resolve PROD digest (pin for verify + deploy)
+        env:
+          GAR_PROD_LOCATION: ${{ vars.GAR_PROD_LOCATION }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+          GAR_PROD_REPOSITORY: ${{ vars.GAR_PROD_REPOSITORY || 'app' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          PROD_REF="${GAR_PROD_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_PROD_REPOSITORY}/${IMAGE_NAME}:${RELEASE_TAG}"
+          DEST_DIGEST=$(gcloud artifacts docker images describe "${PROD_REF}" \
+            --format 'value(image_summary.digest)') || {
+            echo "::error::Could not resolve PROD digest after cosign copy"
+            exit 1
+          }
+          if [ -z "${DEST_DIGEST}" ]; then
+            echo "::error::PROD digest is empty after cosign copy"
+            exit 1
+          fi
+          # Export pinned ref: deploy partial uses IMAGE_TAG from $GITHUB_ENV (avoids TOCTOU on mutable tag)
+          PROD_BASE="${GAR_PROD_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_PROD_REPOSITORY}/${IMAGE_NAME}"
+          echo "IMAGE_TAG=${PROD_BASE}@${DEST_DIGEST}" >> "$GITHUB_ENV"
+          echo "DEST_DIGEST=${DEST_DIGEST}" >> "$GITHUB_ENV"
+
+      - name: cosign verify PROD image (GAR)
+        env:
+          GAR_PROD_LOCATION: ${{ vars.GAR_PROD_LOCATION }}
+          GCP_PROJECT_ID: ${{ vars.GCP_PROJECT_ID }}
+          GAR_PROD_REPOSITORY: ${{ vars.GAR_PROD_REPOSITORY || 'app' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          set -euo pipefail
+          cosign verify \
+            --certificate-identity-regexp 'https://github\.com/<%= githubOwner %>/<%= githubRepo %>/.github/workflows/05-release\.yml@refs/tags/v.*' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${GAR_PROD_LOCATION}-docker.pkg.dev/${GCP_PROJECT_ID}/${GAR_PROD_REPOSITORY}/${IMAGE_NAME}@${DEST_DIGEST}"

package/dist/templates/github/workflows/_cosign-copy/ghcr.ejs

@@ -0,0 +1,76 @@
+      # #1650: cosign copy WRITES a new tag and cosign verify reads it, so this job
+      # must authenticate to the registry first. GitHub Actions does not auto-login the
+      # docker CLI; `packages: write` only scopes GITHUB_TOKEN. The AWS/GCP/Azure
+      # cosign-copy partials already log in — GHCR was the lone path that skipped it.
+      - name: Log in to container registry
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c  # v4.5.2
+        with:
+          registry: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install cosign (keyless OIDC)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+      - name: Resolve IMAGE_SHA from TEST image
+        id: resolve-sha
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          # jq (preinstalled on GitHub runners) keeps digest extraction on one line — a
+          # multi-line `python3 -c` body at column 0 would break the `run: |` block scalar.
+          # #1619: multi-arch manifest lists from `docker manifest inspect` emit LOWERCASE
+          # .platform.os/.digest; some single-arch registries emit capitalized .Platform/.Digest.
+          # Accept either casing so a multi-arch index resolves instead of falling through to
+          # .config.digest (empty/wrong for a manifest-list index).
+          IMAGE_SHA=$(docker manifest inspect "${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}" 2>/dev/null \
+            | jq -r '([.manifests[]? | select((.platform.os // .Platform.os) == "linux") | (.digest // .Digest)][0]) // .config.digest // ""' 2>/dev/null || echo "")
+          if [ -z "${IMAGE_SHA}" ]; then
+            echo "::error::Could not resolve digest for ${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}. Ensure the image was published by the TEST deploy workflow."
+            exit 1
+          fi
+          echo "IMAGE_SHA=${IMAGE_SHA}" >> "$GITHUB_ENV"
+          echo "digest=${IMAGE_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: cosign copy TEST → PROD (GHCR)
+        # cosign copy required — docker/crane tag drops OCI referrers (signatures, SBOM)
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          cosign copy \
+            "${REGISTRY}/${IMAGE_NAME}@${IMAGE_SHA}" \
+            "${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}"
+
+      - name: Resolve PROD digest (pin for verify + deploy)
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          DEST_DIGEST=$(docker manifest inspect "${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}" 2>/dev/null \
+            | jq -r '([.manifests[]? | select((.platform.os // .Platform.os) == "linux") | (.digest // .Digest)][0]) // .config.digest // ""' 2>/dev/null || echo "")
+          if [ -z "${DEST_DIGEST}" ]; then
+            echo "::error::Could not resolve PROD digest after cosign copy"
+            exit 1
+          fi
+          # Export pinned ref: deploy partial uses IMAGE_TAG from $GITHUB_ENV (avoids TOCTOU on mutable tag)
+          echo "IMAGE_TAG=${REGISTRY}/${IMAGE_NAME}@${DEST_DIGEST}" >> "$GITHUB_ENV"
+          echo "DEST_DIGEST=${DEST_DIGEST}" >> "$GITHUB_ENV"
+
+      - name: cosign verify PROD image
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          set -euo pipefail
+          cosign verify \
+            --certificate-identity-regexp 'https://github\.com/<%= githubOwner %>/<%= githubRepo %>/.github/workflows/05-release\.yml@refs/tags/v.*' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${REGISTRY}/${IMAGE_NAME}@${DEST_DIGEST}"

package/dist/templates/github/workflows/_cosign-copy/nas-compose.ejs

@@ -0,0 +1,69 @@
+      # nas-compose delivers from GHCR (the NAS holds a read-only GHCR pull credential),
+      # so the promote-to-PROD mechanics are identical to the ghcr target: cosign copy
+      # writes a new tag, so this job must authenticate to the registry first.
+      - name: Log in to container registry
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c  # v4.5.2
+        with:
+          registry: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Install cosign (keyless OIDC)
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+      - name: Resolve IMAGE_SHA from TEST image
+        id: resolve-sha
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          IMAGE_SHA=$(docker manifest inspect "${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}" 2>/dev/null \
+            | jq -r '([.manifests[]? | select((.platform.os // .Platform.os) == "linux") | (.digest // .Digest)][0]) // .config.digest // ""' 2>/dev/null || echo "")
+          if [ -z "${IMAGE_SHA}" ]; then
+            echo "::error::Could not resolve digest for ${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}. Ensure the image was published by the TEST deploy workflow."
+            exit 1
+          fi
+          echo "IMAGE_SHA=${IMAGE_SHA}" >> "$GITHUB_ENV"
+          echo "digest=${IMAGE_SHA}" >> "$GITHUB_OUTPUT"
+
+      - name: cosign copy TEST → PROD (GHCR)
+        # cosign copy required — docker/crane tag drops OCI referrers (signatures, SBOM)
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          cosign copy \
+            "${REGISTRY}/${IMAGE_NAME}@${IMAGE_SHA}" \
+            "${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}"
+
+      - name: Resolve PROD digest (pin for verify + deploy)
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          DEST_DIGEST=$(docker manifest inspect "${REGISTRY}/${IMAGE_NAME}:${RELEASE_TAG}" 2>/dev/null \
+            | jq -r '([.manifests[]? | select((.platform.os // .Platform.os) == "linux") | (.digest // .Digest)][0]) // .config.digest // ""' 2>/dev/null || echo "")
+          if [ -z "${DEST_DIGEST}" ]; then
+            echo "::error::Could not resolve PROD digest after cosign copy"
+            exit 1
+          fi
+          # Export pinned ref: deploy partial uses IMAGE_TAG from $GITHUB_ENV (avoids TOCTOU on mutable tag)
+          echo "IMAGE_TAG=${REGISTRY}/${IMAGE_NAME}@${DEST_DIGEST}" >> "$GITHUB_ENV"
+          echo "DEST_DIGEST=${DEST_DIGEST}" >> "$GITHUB_ENV"
+
+      - name: cosign verify PROD image (CI-side; the deploy script re-verifies on the NAS)
+        env:
+          REGISTRY: ${{ vars.CONTAINER_REGISTRY || 'ghcr.io' }}
+          IMAGE_NAME: ${{ vars.IMAGE_NAME || 'app' }}
+        run: |
+          set -euo pipefail
+          cosign verify \
+            --certificate-identity-regexp 'https://github\.com/<%= githubOwner %>/<%= githubRepo %>/.github/workflows/05-release\.yml@refs/tags/v.*' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${REGISTRY}/${IMAGE_NAME}@${DEST_DIGEST}"