Merge branch 'main' into fix/sourcemap-override-20261031

.gitea/workflows/ci.yml

@@ -234,9 +234,13 @@ jobs:
       - name: Install Trivy
         run: |
           curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+      # `siax/sbom/` är CycloneDX-evidenens för REDAN BYGGDA images (release-kedjan),
+      # inte källberoenden. Att scanna dem här återrapporterar gamla image-versioner
+      # (next 16.3.x, sharp 0.35.4) och blockerar källfixar som redan är patchade.
+      # Image-SBOM:erna verifieras i release/image-pipelinen.
       - name: Trivy scan (vuln + secrets -- BLOCKING, fails on HIGH/CRITICAL)
         run: |
-          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .
+          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --skip-dirs 'siax/sbom' .
 
   sonar:
     # SonarQube Community Build har inget separat PR-analysläge (en enda "main"-gren

.gitea/workflows/nightly.yml

@@ -45,4 +45,4 @@ jobs:
       # detection was the one guaranteed to stay green. Fixed 2026-09-08.
       - name: Trivy fs scan (vuln + secrets -- fails on HIGH/CRITICAL)
         run: |
-          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .
+          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --skip-dirs 'siax/sbom' .

.gitea/workflows/security.yml

@@ -36,4 +36,4 @@ jobs:
           curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
       - name: Trivy fs scan (vuln + secrets -- fails on HIGH/CRITICAL)
         run: |
-          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .
+          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --skip-dirs 'siax/sbom' .

siax/signing/README.md

@@ -1,4 +1,4 @@
 # 0pt — cosign-signeringskedjan (2026-09-29)
 
-Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-b9443d6419 (sha256:0b952581d82e4910539a7d12fa134261a73a3b1945195d30ac8aa22f0555af80) är cosign-signerad
+Prod-imagen git.cloud.siax.io/sax3l/0pt:prod-d802e451f1 (sha256:0d9eb93b54203216c17fdf52c4f391024a066fdc041aa3cccfbbf75d720087f1) är cosign-signerad
 med nyckelparet vars pubkey ligger här. Privata nyckeln raderad efter signering.

siax/signing/cosign.pub

@@ -1,4 +1,4 @@
 -----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKpcl3LJR2KDFrosHaJHQD3USPawQ
-p/33k32OMkv4TOQPyHW2CqVH9nfElAi4GybqAmiyZYu4GU5C8+UDNtflyQ==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4b/DHjJHfRN2wMYnt1iNtFbODovF
+OfX267+QTH7dCBE6t9xJWmAImXtjcDUjTScaDE9meTcQKv0HxpvYoJAHWA==
 -----END PUBLIC KEY-----

tests/repo/siax-doctor.test.ts

@@ -44,13 +44,13 @@ function runDoctor(root?: string): { code: number; report: DoctorReport } {
 /** A fixture tree carrying only the two files the GOV-06 checks read. */
 function fixture(repo: unknown, evidence: unknown): string {
   const dir = mkdtempSync(path.join(tmpdir(), "siax-doctor-fixture-"));
-  writeFileSync(path.join(dir, "siax.repo.json"), JSON.stringify(repo, null, 2));
+  writeFileSync(path.join(dir, "siax.repo.v3.json"), JSON.stringify(repo, null, 2));
   mkdirSync(path.join(dir, "evidence"), { recursive: true });
   writeFileSync(path.join(dir, "evidence", "operational-state.json"), JSON.stringify(evidence, null, 2));
   return dir;
 }
 
-const REAL_REPO = JSON.parse(readFileSync(path.join(REPO_ROOT, "siax.repo.json"), "utf8"));
+const REAL_REPO = JSON.parse(readFileSync(path.join(REPO_ROOT, "siax.repo.v3.json"), "utf8"));
 const REAL_EVIDENCE = JSON.parse(
   readFileSync(path.join(REPO_ROOT, "evidence", "operational-state.json"), "utf8"),
 );