Fix local CI run errors

.github/actions/setup-tools/action.yml

@@ -1,3 +1,7 @@
+# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+#
 # Composite action that installs the host-side CLI tools the sandbox
 # fixtures and bats suite expect on a runner. Currently:
 #

.github/workflows/REUSE.yaml

@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
       - name: REUSE Compliance Check
-        uses: fsfe/reuse-action@v4
+        uses: fsfe/reuse-action@v6

.github/workflows/ci.yml

@@ -23,18 +23,23 @@
 name: ci
 
 on:
+  # Auto-trigger only when an image manifest changes. The harness itself
+  # (scripts, fixtures, compose, tests) doesn't get re-run on every push
+  # because the test surface is the image set — code changes can be
+  # validated with workflow_dispatch when needed.
   push:
     branches: [main]
+    paths:
+      - "images/**.env"
   pull_request:
-  schedule:
-    # Daily 06:00 UTC - drift detection against floating tags
-    - cron: "0 6 * * *"
+    paths:
+      - "images/**.env"
   workflow_dispatch:
     inputs:
       images:
-        description: "Manifest under images/ (release | default | edge | release-v1.0)"
+        description: "Manifest under images/ (default | release | edge | release-v1.0)"
         type: string
-        default: "release"
+        default: "default"
       skip_sim:
         description: "Skip building and starting ipmi-sim / remote-console"
         type: boolean
@@ -93,7 +98,7 @@ permissions:
   packages: read
 
 env:
-  IMAGES: ${{ inputs.images || 'release' }}
+  IMAGES: ${{ inputs.images || 'default' }}
   SKIP_SIM: ${{ inputs.skip_sim || 'true' }}
   SBX_VAULT_IMAGE: ${{ inputs.sbx_vault_image }}
   SBX_LOCALSTACK_IMAGE: ${{ inputs.sbx_localstack_image }}
@@ -118,12 +123,12 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: tests/go.mod
           cache: true
@@ -133,11 +138,11 @@ jobs:
         uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         continue-on-error: true
 
       - name: Log in to GHCR (read-only)
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -157,16 +162,16 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         continue-on-error: true
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -186,17 +191,17 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install host-side tools (vault, bats)
         uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         continue-on-error: true
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -227,7 +232,7 @@ jobs:
 
       - name: Upload BATS logs on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: bats-logs-${{ github.run_id }}
           path: logs/
@@ -314,10 +319,10 @@ jobs:
             doc: uc7-fru-discovery.md
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: tests/go.mod
           cache: true
@@ -327,11 +332,11 @@ jobs:
         uses: ./.github/actions/setup-tools
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         continue-on-error: true
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -396,7 +401,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.id }}-logs-${{ github.run_id }}
           path: |

.github/workflows/golangci-lint.yaml

@@ -19,15 +19,17 @@ jobs:
       run:
         working-directory: tests
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version-file: tests/go.mod
       - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: latest
+          # `version` is the golangci-lint *binary* version, not the action.
+          # Pinned so it stays in sync with the v2 schema in tests/.golangci.yml.
+          version: v2.12.2
           working-directory: tests
           args: --build-tags=integration

.github/workflows/sandbox-consumer.example.yaml

@@ -37,29 +37,29 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out the consumer repo (the service under test)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: service
           fetch-depth: 0
 
       - name: Check out the sandbox harness
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: OpenCHAMI/integration-sandbox
           path: integration-sandbox
           # Optional: pin to a sandbox release tag instead of main.
           # ref: v1.0.0
 
       - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: "1.24.6"
 
       - name: Install bats
         run: sudo apt-get update && sudo apt-get install -y bats
 
       - name: Log in to GHCR (read-only)
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -89,7 +89,7 @@ jobs:
 
       - name: Upload log bundle on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: sandbox-logs
           path: integration-sandbox/logs/

.github/workflows/stale.yaml

@@ -17,7 +17,7 @@ jobs:
   run-stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           days-before-stale: 35
           days-before-close: 7

.secrets.example

@@ -1,3 +1,7 @@
+# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 # Template for the `.secrets` file act reads with --secret-file .secrets.
 # Copy to .secrets (gitignored) and edit if needed.
 #

Dockerfile.act

@@ -1,3 +1,7 @@
+# Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
 FROM ghcr.io/catthehacker/ubuntu:full-latest
 
 # Install docker-compose if not present

Makefile

@@ -1,10 +1,11 @@
 .DEFAULT_GOAL := help
 
 ROOT := $(shell pwd)
-# Default to the `release` manifest — each OpenCHAMI service is pinned to its
-# latest GitHub Release tag (regenerate with `make refresh-releases`). Use
-# IMAGES=default for the floating :latest tags, IMAGES=edge for :main builds.
-IMAGES ?= release
+# Default to the `default` manifest — the verified known-good PR-tag mix
+# (see images/default.env header for the date it was last validated).
+# IMAGES=release pins to the latest GitHub Release tags (regenerate with
+# `make refresh-releases`); IMAGES=edge tracks :main for drift detection.
+IMAGES ?= default
 COMPOSE := docker compose -f compose/infra.yaml -f compose/bmc-sim.yaml -f compose/core.yaml
 
 # Export so scripts/load-images.sh sees it.
@@ -15,9 +16,9 @@ export IMAGES
 help: ## Show this help
 	@grep -E '^[a-zA-Z_-]+:.*?## ' $(MAKEFILE_LIST) | awk -F':.*## ' '{printf "  %-20s %s\n", $$1, $$2}'
 	@echo ""
-	@echo "Image selection (default: release — latest GitHub Release tag of each service):"
-	@echo "  make ci                                                  # images/release.env (default)"
-	@echo "  make ci IMAGES=default                                   # images/default.env (floating :latest)"
+	@echo "Image selection (default: default — verified known-good PR-tag mix):"
+	@echo "  make ci                                                  # images/default.env (default)"
+	@echo "  make ci IMAGES=release                                   # images/release.env (latest GH Releases)"
 	@echo "  make ci IMAGES=edge                                      # images/edge.env (:main builds)"
 	@echo "  make ci IMAGES=release-v1.0                              # images/release-v1.0.env (pinned snapshot)"
 	@echo "  make ci SBX_TOKENSMITH_IMAGE=ghcr.io/openchami/tokensmith:pr-23"

REUSE.toml

@@ -44,6 +44,13 @@ precedence = "aggregate"
 SPDX-FileCopyrightText = "Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC"
 SPDX-License-Identifier = "MIT"
 
+# JSON config files (no comment syntax → must be covered here, not via header).
+[[annotations]]
+path = [".github/renovate.json"]
+precedence = "aggregate"
+SPDX-FileCopyrightText = "Copyright © 2026 OpenCHAMI a Series of LF Projects, LLC"
+SPDX-License-Identifier = "MIT"
+
 # Markdown documentation.
 [[annotations]]
 path = "**.md"

compose/bmc-sim.yaml

@@ -41,7 +41,7 @@ x-redfish-bmc: &redfish-bmc
       mkdir -p /tmp/tls
       openssl req -x509 -newkey rsa:2048 -nodes \
         -keyout /tmp/tls/key.pem -out /tmp/tls/cert.pem \
-        -days 365 -subj "/CN=${HOSTNAME}" 2>/dev/null
+        -days 365 -subj "/CN=$${HOSTNAME}" 2>/dev/null
       exec sushy-emulator --fake -i :: -p 443 \
         --ssl-certificate /tmp/tls/cert.pem \
         --ssl-key /tmp/tls/key.pem

compose/core.yaml

@@ -118,7 +118,7 @@ services:
     command:
       - "serve"
       - "--port=27793"
-      - "--database-url=file:/data/fru.db?cache=shared&_fk=1"
+      - "--database-url=file:/data/fru.db?cache=shared&_fk=1&_busy_timeout=5000&_journal_mode=WAL"
     tmpfs:
       - /data:mode=1777
     ports:
@@ -127,6 +127,7 @@ services:
 
   power-control:
     image: ${SBX_POWER_IMAGE:-ghcr.io/openchami/pcs:pr-68}
+    platform: linux/amd64
     container_name: sandbox-power
     # power-control's Vault credstore (HMS hms-securestorage) only authenticates
     # to Vault via the K8s service-account JWT flow — VAULT_TOKEN is ignored.

fixtures/vault-seed.sh

@@ -8,11 +8,19 @@ set -euo pipefail
 VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
 VAULT_TOKEN="${VAULT_TOKEN:-dev-root-token}"
 CLUSTER="${CLUSTER:-sandbox}"
+CONTAINER="${VAULT_CONTAINER:-sandbox-vault}"
 
 export VAULT_ADDR VAULT_TOKEN
 
 XNAMES=(x0c0s0b0 x0c0s1b0 x0c0s2b0 x0c0s3b0 x0c0s4b0 x0c0s5b0 x0c0s6b0 x0c0s7b0)
 
+vault() {
+  docker exec -i \
+    -e VAULT_ADDR="$VAULT_ADDR" \
+    -e VAULT_TOKEN="$VAULT_TOKEN" \
+    "$CONTAINER" vault "$@"
+}
+
 # --- KV-v2 namespace for cluster-wide secrets (mirrors openchami-operator) ---
 vault secrets enable -path=openchami kv-v2 2>/dev/null || true