Follow-ups: prebuilt toolchain image (PR #1300)

[Wikid82]

Non-blocking follow-ups from the prebuilt Caddy/CrowdSec toolchain image work (PR #1300). None blocks that PR; grouped here for tracking.

1. Enroll the freshness guard as a required check

verify-toolchain-pin and the Toolchain key / freshness-guard scripts (bats) job are wired to run on every PR but are only load-bearing as merge gates if they are required status checks in branch protection for main (and development). Add them.

2. Pin caddy-geoip2 to a real upstream tag

github.com/zhangjiayin/caddy-geoip2 publishes no semver tags, so CADDY_GEOIP2_VERSION currently carries a Go pseudo-version (v0.0.0-20260623062220-3675c6e7e63d) and Renovate cannot track it. It is in the toolchain content-hash key, so a manual bump is guard-caught — but pin to a real tag once upstream cuts one, and restore the # renovate: datasource=go tracking.

3. Widen the freshness-guard bats matrix

scripts/tests/verify-toolchain-pin.bats asserts five failure-closed modes. Add cases for the two currently-uncovered branches (:$KEY unresolvable in the registry; empty CHARON_TOOLCHAIN_DIGEST) and add tonistiigi/xx + ALPINE_IMAGE per-input sensitivity tests to toolchain-key.bats.

4. Pin the regctl release version

iarekylew00t/regctl-installer@… in .github/workflows/quality-checks.yml installs regctl-release: latest. Pin it to an exact version for reproducibility.

5. Periodic CI coverage of make build-offline

The fork/offline whole-app inline build path (CADDY_BUILDER_SRC=caddy-inline) is only exercised on fork PRs today. Add a scheduled or label-gated CI job that runs make build-offline so same-repo changes can't silently break it. (The inline stage bodies themselves are compiled daily by toolchain-image.yml.)

---

Refs: PR #1300, docs/plans/current_spec.md, docs/reports/qa_report.md.

[Wikid82]

F1 (required status checks) — DONE. Added a required_status_checks rule to the charon rules ruleset (id 10078859), enforced on main / development / nightly / feature/** / hotfix/**. 17 contexts: Backend/Frontend/Agent (Go), build-amd64/arm64, Build Charon image, merge-and-publish, CodeQL, Semgrep SAST Scan, Verify Supply Chain, Auth Route Protection Contract, the 4 integration suites, verify-toolchain-pin, and the toolchain bats job. strict: false; existing Admin + integration bypass actors preserved (covers the legitimately-red verify-toolchain-pin on main → development propagation PRs — merge via admin bypass + follow-up pin-bump, as done for #1307/#1312).

Deliberately excluded and why: E2E (E2E Test Results (Final)) is path-filtered and skips on workflow/docs-only PRs — needs an always-report shim first; codecov/patch kept as a soft gate; Trivy/toolchain-image scans are conditional; Muzzle Allowlist Parity (backend/agent, has a malformed context name (trailing comma) — needs a job-name fix before it can be pinned.

Items 2–5 (regctl pin, wider bats matrix, make build-offline CI, caddy-geoip2 pin) still open — regctl pin + bats matrix in progress on ci/toolchain-followups-1304.

[Wikid82]

Items 2 & 3 — PR #1313 (regctl pinned to v0.11.6; freshness-guard bats matrix widened with unresolvable-:$KEY, blank-digest, absent-digest-ARG, and xx/ALPINE_IMAGE key-sensitivity cases; also hardened verify-toolchain-pin.sh so a missing digest ARG fails with the actionable error instead of aborting under set -euo pipefail).

Item 5 — PR #1314 (build-offline canary: new advisory .github/workflows/build-offline.yml, amd64-only make build-offline, workflow_dispatch + weekly schedule: '0 8 * * 3' + paths:-filtered on Dockerfile/.dockerignore/Makefile; not a required check. First cold run: 6m50s).

Remaining open: item 4 — pin caddy-geoip2 once github.com/zhangjiayin/caddy-geoip2 publishes a real semver tag (currently a Go pseudo-version, Renovate-untracked). Watch item, no action possible until upstream tags.

[Wikid82]

All actionable follow-ups are done:

• 1. Freshness guard as a required check — Toolchain pin freshness (verify-toolchain-pin) and Toolchain key / freshness-guard scripts (bats) are both required status checks in the active charon rules ruleset (main, development, feature/, nightly, hotfix/).
• 3. Widen the freshness-guard bats matrix — done in ci: pin regctl release + widen toolchain freshness-guard bats coverage (#1304) #1313 (both previously-uncovered verify-toolchain-pin branches; tonistiigi/xx + ALPINE_IMAGE sensitivity tests in toolchain-key.bats).
• 4. Pin the regctl release version — done in ci: pin regctl release + widen toolchain freshness-guard bats coverage (#1304) #1313 (regctl-release: v0.11.6 in quality-checks.yml).
• 5. Periodic CI coverage of make build-offline — done in ci: add offline (inline-toolchain) build canary workflow (#1304) #1314 (.github/workflows/build-offline.yml, scheduled Wed 08:00 UTC + workflow_dispatch + paths).

2. Pin caddy-geoip2 to a real upstream tag is blocked on upstream publishing a semver tag; it's guard-caught via the toolchain key in the meantime. Split out to #1329 as a standalone tracker.

Closing.