fix(security): keep profile exports out of source and image contexts

Route automatic profile exports to a managed store instead of the current checkout, and enforce a CI/Docker boundary that rejects archive files before they can be published.
2026-08-23 01:00:30 -03:00
parent b6f42c667a
commit c26f75baab
13 changed files with 369 additions and 14 deletions
@@ -107,9 +107,10 @@ plans/
 .hadolint.yaml
 .mailmap

-# Repo-root debug/export artifacts — must never reach image layers (COPY . .)
+# Debug/export artifacts — must never reach image layers (COPY . .)
 /log.txt
 /sqlite_leak_fix.png
 /*.png.bak
 /default.tar.gz
-/*.tar.gz
+*.tar.gz
+*.tgz