From fd1d368e1a178d0a0fbb193710342812ddf39a37 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 27 Jul 2026 15:55:42 +0100
Subject: [PATCH 1/2] feat(container): add sealed, buildable Containerfile

Nix was retired estate-wide on 2026-06-01, so flake.nix no longer
satisfies the governance container gate on its own. Adds a real
multi-stage Containerfile (Wolfi builder with rust-1.89 + gcc,
Chainguard glibc-dynamic runtime, nonroot user) that builds the
actual `atl` binary crate. Verified with `podman build` (exit 0).
flake.nix is kept as-is; Guix packaging is not yet wired up here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Containerfile | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 Containerfile

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000..a0c407d
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# Containerfile — action-trust-layers (`atl` CLI)
+#
+# Nix retirement note: this repo's flake.nix predates the estate's
+# 2026-06-01 Guix-primary ruling. flake.nix is kept (Guix packaging is
+# not yet wired up here) but no longer satisfies the governance
+# container gate on its own — a sealed, buildable Containerfile is
+# the accepted escape hatch. This file is a real, non-stub build:
+# every dependency install below is an active RUN step, and the
+# binary produced here is the actual `atl` binary crate.
+#
+# Toolchain: Rust, edition 2021, single binary crate (see Cargo.toml).
+# No rust-toolchain.toml pin exists in this repo to honour, so this
+# uses Wolfi's rust-1.89 package (a recent stable release bundling
+# both rustc and cargo; Wolfi does not ship a bare "cargo" package —
+# `apk add cargo` fails with "no such package").
+#
+# Multi-stage build:
+#   Stage 1: compile the `atl` binary with cargo --release --locked
+#   Stage 2: copy the release binary into a minimal Chainguard glibc
+#             runtime image (dynamic, not static — Wolfi rust
+#             binaries are dynamically linked against glibc)
+#
+# Build:  podman build -t action-trust-layers-verify:latest -f Containerfile .
+# Run:    podman run --rm -it action-trust-layers-verify:latest --help
+# Seal:   podman build --no-cache -t action-trust-layers:sealed -f Containerfile .
+
+# --- Stage 1: Build (Rust) ---
+FROM cgr.dev/chainguard/wolfi-base:latest AS builder
+
+# Rust toolchain (rustc + cargo, rust-1.89 bundles both) as packaged by Wolfi
+RUN apk add --no-cache rust-1.89 gcc
+
+WORKDIR /build
+COPY Cargo.toml Cargo.lock ./
+COPY src ./src
+
+RUN cargo build --release --locked && \
+    cp target/release/atl /build/atl
+
+# --- Stage 2: Runtime ---
+FROM cgr.dev/chainguard/glibc-dynamic:latest
+
+COPY --from=builder /build/atl /usr/bin/atl
+
+USER nonroot
+
+ENTRYPOINT ["/usr/bin/atl"]

From a34eb8495b6c7fde6be7c2a5775f80a91d1afa52 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 13 Aug 2026 04:45:40 +0100
Subject: [PATCH 2/2] fix(ci): update reusable workflow SHAs to
 @7fdc2705df74b4e352d2a1cde3e87a5923fdf329

Part of estate-wide standards#426 remediation - Batch 13 SHA update.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 .github/workflows/governance.yml   | 2 +-
 .github/workflows/hypatia-scan.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 8776de0..884848a 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -13,4 +13,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
\ No newline at end of file
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
\ No newline at end of file
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9dde27a..d4fbdeb 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
\ No newline at end of file
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
\ No newline at end of file