gate

# .github agent notes

- Gate publishes through the default-branch `.github/workflows/release-publish.yml` reusable workflow; the default-branch-only release-please workflow calls it with the selected tag as input, including after its repository-dispatch rerun, so tag-authored workflow steps never receive write credentials. Its release and container paths have two trust zones: `release-build`/`image-build` run the checked-out tag with `contents: read` and stage allowlisted release assets/OCI archives, while fresh `publish-release`/`publish-images` jobs check out nothing and alone hold `contents: write`/`packages: write`. Keep workflow-level permissions empty, checkout credentials disabled in code-running jobs, and the artifact handoffs explicit; contracts live in `ci_write_token_isolation_test.go`. The final release guard re-reads GitHub rather than trusting local output (`release_asset_verification_test.go`) and must remain the publisher's last step.
- Releases already published with no assets are repaired by `.github/workflows/release-repair.yml` (manual dispatch from the default branch, contract pinned by `release_repair_workflow_test.go`). Its two-job boundary is load-bearing: only `build` checks out and runs the selected tag with `contents: read`, while fresh `publish` has `contents: write`, checks out nothing, and uploads only the allowlisted artifact; the workflow has no ambient permission and no registry scope, so a backward `ghcr.io/minekube/gate:latest` retag is unrepresentable. The repair procedure and historical-tag gotchas are in `.agents/skills/release-repair/SKILL.md`.

More agent context in minekube/gate

6 other files this repository gives its agents.