Promote main to lts

[github-actions]

SummaryPromotion of tested changes from to production branch.IMPORTANT: This PR should ONLY contain commits from → . Never merge in the opposite direction.

[dosubot]

Related Documentation

3 document(s) may need updating based on files changed in this PR:

bluefin

Bluefin Newsletter 2.0

View Suggested Changes

@@ -1,7 +1,7 @@
 ## Recent Completed Work
 | Date Completed | Task | Overview | Impact |
 |---|---|---|---|
-| 2026-03-02 | Prevent Branch Pollution with Manual LTS Promotion | A comprehensive three-layer defense was implemented to prevent branch pollution. **Layer 1:** The automated Pull app (`.github/pull.yml`) was removed and replaced with a manual `.github/workflows/promote-to-lts.yml` workflow triggered via workflow_dispatch, requiring manual operator approval for promotions. **Layer 2:** Renovate configuration updated with `baseBranchPatterns: ["main"]` to restrict automated PRs to the main branch only, preventing dependency updates on lts. **Layer 3:** Added `lts` to push triggers in 5 build workflows (build-dx-hwe.yml, build-dx.yml, build-gdx.yml, build-regular-hwe.yml, build-regular.yml) to enable validation builds that catch accidental merges. | Protects production lts branch from automated updates and prevents reverse merges. Ensures controlled, deliberate promotions from main to lts via explicit human action. Validation builds provide safety net against accidental merges without publishing. [Details](https://github.com/ublue-os/bluefin-lts/pull/1152) |
+| 2026-03-02 | Prevent Branch Pollution with Manual LTS Promotion | A comprehensive defense system was implemented to prevent branch pollution and ensure controlled production releases. **Layer 1: Manual Promotion** — The automated Pull app (`.github/pull.yml`) was removed and replaced with `.github/workflows/promote-to-lts.yml`, triggered manually via workflow_dispatch, requiring explicit operator approval for all main → lts promotions. **Layer 2: Renovate Restriction** — Renovate configuration updated with `baseBranchPatterns: ["main"]` to restrict all automated dependency PRs to the main branch only, preventing direct updates to lts. **Layer 3: Validation Builds** — Added `lts` to push triggers in 5 build workflows to enable validation-only builds that catch accidental merges without publishing. **Layer 4: Scheduled Dispatcher** — Added `.github/workflows/scheduled-lts-release.yml`, a centralized dispatcher running weekly on Tuesday at 6 AM UTC that triggers all 5 build workflows on the lts branch. Individual workflows no longer have schedule triggers. **Publish Logic** — Workflows now publish only from main on push events or from main/lts on workflow_dispatch; lts push events trigger validation-only builds. **SBOM Generation** — SBOM generation is lts-branch-only with continue-on-error for reliability. | Protects production lts branch from automated updates, prevents reverse merges, and ensures controlled promotions via explicit human action. Weekly automated releases simplify production deployment. Validation builds provide a safety net against accidental merges. [Details](https://github.com/ublue-os/bluefin-lts/pull/1152) |
 | 2026-02-12 | Simplify Renovate Automerge Configuration | Renovate automerge configuration refactored from an allowlist approach to a universal pattern-based approach. All digest/pin/pinDigest updates across all managers (Dockerfile, GitHub Actions, regex/Justfile) are enabled for automerge, replacing fragmented per-container rules. GitHub Actions minor/patch version bumps also automerge. NVIDIA driver digests remain manual for compatibility review. | Reduces manual PR review for all dependency digest updates with simpler, more comprehensive automation rules. Improves security posture and reduces maintenance overhead. [Details](https://github.com/ublue-os/bluefin-lts/pull/1105) |
 | 2026-01-31 | Add ibus-chewing to Bluefin LTS for zh_TW | The ibus-chewing input method is now included in Bluefin LTS, matching the default for the zh_TW locale in Bluefin Stable. This resolves issues where Chewing was configured but not available when installing from older ISOs, and improves the Traditional Chinese typing experience out of the box. | Ensures consistent and functional Traditional Chinese input for zh_TW users on both Stable and LTS. Reduces manual configuration and improves i18n parity. [Details](https://github.com/ublue-os/bluefin-lts/pull/1076) |
 | 2025-12-16 | Reintroduce Renovate Automation | The Renovate dependency automation was restored. The `.github/renovate.json5` configuration was updated to include `ghcr.io/projectbluefin/common` in the automerge dependencies, ensuring that updates to this key dependency are now automatically merged. | Keeps dependencies up to date with less manual intervention, improving security and reliability. [Details](https://github.com/ublue-os/bluefin/pull/3853) |
@@ -24,7 +24,7 @@
 ## Summary Table
 | Date       | Change Summary |
 |------------|---------------|
-| 2026-03-02 | Renovate restricted to main branch; Pull app replaced with manual promotion workflow; validation builds added to lts branch |
+| 2026-03-02 | Renovate restricted to main branch; Pull app replaced with manual promotion workflow; scheduled weekly dispatcher added; validation builds added to lts branch; SBOM generation lts-only |
 | 2026-02-12 | Renovate automerge refactored from allowlist to universal pattern-based rules covering all digest/pin updates |
 | 2026-01-31 | ibus-chewing input method added to Bluefin LTS for zh_TW locale parity |
 | 2025-12-16 | Renovate automation restored for `ghcr.io/projectbluefin/common` |

[Accept] [Decline]

Custom Image Build System

View Suggested Changes

@@ -118,6 +118,10 @@
 - [validate-justfiles.yml](https://github.com/projectbluefin/finpilot/blob/f2240c52b1c188a52009fe0d1dffefefd8e86d2a/.github/workflows/validate-justfiles.yml): Validates just file syntax
 - [validate-shellcheck.yml](https://github.com/projectbluefin/finpilot/blob/f2240c52b1c188a52009fe0d1dffefefd8e86d2a/.github/workflows/validate-shellcheck.yml): Runs shellcheck on build scripts
 
+**Bluefin Workflow Architecture:**
+- [scheduled-lts-release.yml](https://github.com/ublue-os/bluefin-lts/blob/lts/.github/workflows/scheduled-lts-release.yml): Centralized dispatcher that runs weekly (Tuesday 6 AM UTC) and triggers all five build workflows via workflow_dispatch on the lts branch
+- [promote-to-lts.yml](https://github.com/ublue-os/bluefin-lts/blob/lts/.github/workflows/promote-to-lts.yml): Manual workflow for creating pull requests to promote changes from main to lts branch
+
 ## Kernel and Driver Integration (akmods)
 
 ### akmods Infrastructure
@@ -212,10 +216,12 @@
 
 [The reusable workflow system uses a two-job structure](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml): [the check-build-required job determines if builds are needed](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml#L24-L137), and [the build_ublue job executes the actual build pipeline](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml#L138-L263).
 
-[Intelligent build triggers use digest-based version tracking](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml#L74-L107) that compares SHA256 hashes between branches to determine if builds are required, triggering automatically when:
-- [Base image digests change (Fedora upstream updates)](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml#L86-L89)
-- [Akmods digests change (kernel module updates)](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml#L91-L94)
-- [Source file modifications (code or configuration changes)](https://github.com/ublue-os/main/blob/5ef6bb2adf95dd36b4d428e643a88ad510b7b988/.github/workflows/reusable-build.yml#L109-L136)
+**Intelligent build triggers** use digest-based version tracking that compares SHA256 hashes between branches to determine if builds are required, triggering automatically when:
+- Base image digests change (Fedora upstream updates)
+- Akmods digests change (kernel module updates)
+- Source file modifications (code or configuration changes)
+
+**Centralized scheduling** - Individual build workflows (build-regular.yml, build-dx.yml, build-gdx.yml, build-regular-hwe.yml, build-dx-hwe.yml) no longer have schedule triggers. Instead, the [scheduled-lts-release.yml workflow](https://github.com/ublue-os/bluefin-lts/blob/lts/.github/workflows/scheduled-lts-release.yml) runs weekly on Tuesday at 6 AM UTC and dispatches all five build workflows via workflow_dispatch on the lts branch. Pull request triggers remain active only on the main branch, as the lts branch has been removed from pull_request triggers.
 
 ### Renovate Bot Integration
 
@@ -264,15 +270,15 @@
 
 ### Container Registry Integration
 
-[Images are pushed to ghcr.io with retry logic after validation](https://github.com/ublue-os/bluefin/blob/3f18fcfb4b16d8ae005cef071395c0132672ebce/.github/workflows/reusable-build.yml#L181-L197). Organizations can publish to private registries (Harbor, Artifactory, self-hosted container registry) by configuring registry credentials in CI/CD systems.
+Images are pushed to ghcr.io with retry logic after validation. The publish condition has been updated: `(github.event_name == 'workflow_dispatch' && (github.ref == 'refs/heads/lts' || github.ref == 'refs/heads/main')) || (github.event_name == 'push' && github.ref == 'refs/heads/main')`. This means workflow_dispatch events can publish from either main or lts branches, while push events only publish from main. Organizations can publish to private registries (Harbor, Artifactory, self-hosted container registry) by configuring registry credentials in CI/CD systems.
 
 ### Image Versioning and Tagging
 
-[Image versions follow the format: stream-fedora_version.YYYYMMDD[.point]](https://github.com/ublue-os/bluefin/blob/1a5c8d9e5aaf38c7b10f35d7162f5f36d9f883f7/Justfile#L156-L171). Custom images should adopt similar versioning schemes to enable reproducibility and easy referencing.
+[Image versions follow the format: stream-fedora_version.YYYYMMDD[.point]](https://github.com/ublue-os/bluefin/blob/1a5c8d9e5aaf38c7b10f35d7162f5f36d9f883f7/Justfile#L156-L171). The manifest job applies a `-testing` suffix to images built from non-production branches, with the tag suffix logic updated to append to any existing centos_version_suffix (e.g., `-hwe-testing` for HWE builds on non-production branches). Custom images should adopt similar versioning schemes to enable reproducibility and easy referencing.
 
 ### SBOM Generation
 
-SBOM (Software Bill of Materials) generation using Syft provides supply chain transparency. [The system uses Syft to scan container images and generate SBOMs](https://github.com/ublue-os/bluefin/blob/1a5c8d9e5aaf38c7b10f35d7162f5f36d9f883f7/.github/workflows/reusable-build.yml#L85-L111), which are attached as attestations to signed images.
+SBOM (Software Bill of Materials) generation using Syft provides supply chain transparency. SBOM generation now only occurs on the lts branch and has `continue-on-error: true` enabled to prevent attestation failures from blocking builds. The sbom input parameter has been removed from reusable-build-image.yml, with SBOM generation automatically triggered for lts branch builds when publishing is enabled. SBOMs are attached as attestations to signed images.
 
 ## Extending and Customizing Bluefin
 
@@ -361,6 +367,8 @@
 | `build_files/base/03-install-kernel-akmods.sh` | Kernel and driver installation | Bash |
 | `build_files/base/04-packages.sh` | Package installation logic | Bash |
 | `.github/workflows/reusable-build.yml` | CI/CD build pipeline | YAML |
+| `.github/workflows/scheduled-lts-release.yml` | Centralized LTS build dispatcher | YAML |
+| `.github/workflows/promote-to-lts.yml` | Main to LTS promotion workflow | YAML |
 | `build_files/shared/build.sh` | Main build orchestration | Bash |
 | `build/10-build.sh` (finpilot) | Main finpilot build script | Bash |
 | `build/copr-helpers.sh` (finpilot) | COPR repository helpers | Bash |

[Accept] [Decline]

Kernel Version Management

View Suggested Changes

@@ -6,7 +6,7 @@
 
 The kernel management strategy differs significantly between release streams: [gts and stable streams use the coreos-stable flavor coordinated with Fedora CoreOS](https://github.com/ublue-os/bluefin/blob/c22e0cac0740d478c8c8d009f7a4e54250a9e3e5/Justfile#L116-L125), tracking kernels that arrive approximately [two weeks after landing in Fedora](https://github.com/ublue-os/bluefin/discussions/2709#discussioncomment-13605116), while [latest and beta streams use the main flavor with unpinned latest Fedora kernels](https://github.com/ublue-os/bluefin/blob/c22e0cac0740d478c8c8d009f7a4e54250a9e3e5/Justfile#L116-L125). [Kernel packages are persistently pinned using dnf5 versionlock](https://github.com/ublue-os/bluefin/blob/c22e0cac0740d478c8c8d009f7a4e54250a9e3e5/build_files/base/03-install-kernel-akmods.sh#L34) to maintain compatibility with pre-compiled kernel modules for NVIDIA drivers, ZFS, and other out-of-tree components.
 
-Bluefin LTS extends this model with [two kernel options: the standard lts tag uses the CentOS 6.12 kernel, while lts-hwe uses the CoreOS kernel with hardware enablement](https://app.dosu.dev/documents/317cf1da-6dda-45d0-bad4-5645878ac451). [Automated weekly releases occur on Sundays at 2 AM UTC](https://github.com/ublue-os/bluefin-lts/pull/1138), [managed through a centralized dispatcher workflow](https://github.com/ublue-os/bluefin-lts/pull/1147) that prevents accidental production releases from automated dependency updates.
+Bluefin LTS extends this model with [two kernel options: the standard lts tag uses the CentOS 6.12 kernel, while lts-hwe uses the CoreOS kernel with hardware enablement](https://app.dosu.dev/documents/317cf1da-6dda-45d0-bad4-5645878ac451). [Automated weekly releases occur on Tuesdays at 6 AM UTC](https://github.com/ublue-os/bluefin-lts/pull/1176), [managed through a centralized dispatcher workflow](https://github.com/ublue-os/bluefin-lts/pull/1176) that prevents accidental production releases from automated dependency updates.
 
 ## Release Streams and Kernel Coordination
 
@@ -164,20 +164,28 @@
 **Dual-Branch Model:**
 
 - **main branch**: [Continuous testing builds published to `:lts-testing` with every push](https://github.com/ublue-os/bluefin-lts/pull/1138)
-- **lts branch**: [Production releases only on scheduled runs or manual workflow_dispatch](https://github.com/ublue-os/bluefin-lts/pull/1138)
+- **lts branch**: [Push events trigger validation-only builds without publishing](https://github.com/ublue-os/bluefin-lts/pull/1176); production releases occur only via workflow_dispatch (scheduled or manual)
 
 **Scheduling Architecture:**
 
-[All five build workflows use the cron schedule `'0 2 * * 0'` (Sunday 2 AM UTC)](https://github.com/ublue-os/bluefin-lts/pull/1138):
+[The scheduled-lts-release.yml dispatcher workflow runs on the cron schedule `'0 6 * * 2'` (Tuesday 6 AM UTC)](https://github.com/ublue-os/bluefin-lts/pull/1176) and triggers all five build workflows on the lts branch via workflow_dispatch:
 - build-regular.yml
 - build-dx.yml
 - build-gdx.yml
 - build-regular-hwe.yml
 - build-dx-hwe.yml
 
-[Because GitHub Actions scheduled triggers always run on the default branch (main)](https://github.com/ublue-os/bluefin-lts/pull/1147), [a dedicated scheduled-lts-release.yml dispatcher workflow triggers all 5 build workflows on the lts branch](https://github.com/ublue-os/bluefin-lts/pull/1147).
-
-[The generate-release.yml workflow automatically generates changelogs and creates GitHub releases when the GDX build completes on schedule](https://github.com/ublue-os/bluefin-lts/pull/1138), ensuring proper release documentation.
+[Individual build workflows no longer contain schedule triggers](https://github.com/ublue-os/bluefin-lts/pull/1176); instead, scheduled-lts-release.yml serves as a centralized dispatcher. [This architecture ensures scheduled builds always execute on the lts branch regardless of the repository default branch](https://github.com/ublue-os/bluefin-lts/pull/1176).
+
+**Publishing Logic:**
+
+[Builds triggered via workflow_dispatch can publish from both main and lts branches, while push events only publish from main](https://github.com/ublue-os/bluefin-lts/pull/1176). [Push events to lts run validation builds without publishing, preventing accidental production releases from direct commits](https://github.com/ublue-os/bluefin-lts/pull/1176).
+
+**Promotion Workflow:**
+
+[The promote-to-lts.yml workflow enables manual promotion of tested changes from main to lts](https://github.com/ublue-os/bluefin-lts/pull/1176). [This workflow creates pull requests for review, ensuring controlled promotion of changes to production](https://github.com/ublue-os/bluefin-lts/pull/1176).
+
+[The generate-release.yml workflow automatically generates changelogs and creates GitHub releases when the GDX build completes via workflow_dispatch](https://github.com/ublue-os/bluefin-lts/pull/1176), ensuring proper release documentation. [SBOM attestation is lts-branch-only with continue-on-error enabled](https://github.com/ublue-os/bluefin-lts/pull/1176).
 
 ### Image Versioning
 

[Accept] [Decline]

Note: You must be authenticated to accept/decline updates.

^{How did I do? Any feedback?}  

[castrojo]

Closing in favour of the new squash-push promotion workflow (PR #1177). Merging this PR would create a merge commit — exactly the history pollution the new workflow is designed to prevent. The promotion will be re-run via promote-to-lts.yml after resetting lts to main.