release: publish protected multi-architecture Codex Security images (#17)

* release: publish protected multi-architecture Codex Security images

* test: keep customer container coverage mirror-safe

* test: verify empty repository inventories fail safely

* fix: select legacy sandbox only on AppArmor-restricted hosts

* fix: detect AppArmor restrictions without trailing newlines

* fix: promote verified and attested container releases safely

* fix: support restricted Ubuntu container scans safely

* fix: bind clean scans to their pinned Git revision

* fix: verify published platform images and preserve sandbox overrides

---------

Co-authored-by: mldangelo-oai <mdangelo@openai.com>

Author: dc-oai

.github/workflows/container-ci.yml

@@ -9,6 +9,7 @@ on:
       - Dockerfile
       - Dockerfile.dockerignore
       - compose.yaml
+      - compose.apparmor.yaml
       - docker/**
       - sdk/typescript/**
   pull_request:
@@ -18,6 +19,7 @@ on:
       - Dockerfile
       - Dockerfile.dockerignore
       - compose.yaml
+      - compose.apparmor.yaml
       - docker/**
       - sdk/typescript/**
   workflow_dispatch:
@@ -105,6 +107,11 @@ jobs:
           docker compose config --quiet
           docker compose run --rm codex-security --version
 
+      - name: Validate optional AppArmor Compose configuration
+        env:
+          CODEX_SECURITY_IMAGE: codex-security:ci
+        run: docker compose -f compose.yaml -f compose.apparmor.yaml config --quiet
+
       - name: Verify hardened Codex command sandbox
         shell: bash
         run: |