chore(sync): synced file(s) with cplieger/ci

.github/workflows/ci.yaml

@@ -33,4 +33,4 @@ concurrency:
 
 jobs:
   ci:
-    uses: cplieger/ci/.github/workflows/ci.yaml@f32f5781220cca329df97b3df578363747e04259 # v2
+    uses: cplieger/ci/.github/workflows/ci.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2

.github/workflows/codeql.yml

@@ -16,4 +16,4 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: cplieger/ci/.github/workflows/codeql.yaml@f32f5781220cca329df97b3df578363747e04259 # v2
+    uses: cplieger/ci/.github/workflows/codeql.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2

.github/workflows/coverage.yml

@@ -27,4 +27,4 @@ jobs:
     # NOTE: pin this @SHA to the ci release tag that first contains
     # coverage.yaml when cutting that tag (see ci.md "Updating and propagating").
     # Renovate then tracks the `# v2` comment and bumps the digest thereafter.
-    uses: cplieger/ci/.github/workflows/coverage.yaml@f32f5781220cca329df97b3df578363747e04259 # v2
+    uses: cplieger/ci/.github/workflows/coverage.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2

.github/workflows/release.yaml

@@ -63,7 +63,7 @@ jobs:
       id-token: write
       attestations: write
       security-events: write
-    uses: cplieger/ci/.github/workflows/release.yaml@f32f5781220cca329df97b3df578363747e04259 # v2
+    uses: cplieger/ci/.github/workflows/release.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2
     # Forward only the two Docker Hub publish credentials the reusable pipeline
     # actually declares and consumes, rather than `secrets: inherit` (which
     # exposes every repo secret to the reusable-workflow trust boundary). Both

.github/workflows/scorecard.yml

@@ -52,6 +52,6 @@ jobs:
           retention-days: 5
 
       - name: Upload SARIF to code-scanning
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif

.github/workflows/security.yml

@@ -22,4 +22,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: cplieger/ci/.github/workflows/security-scan.yaml@f32f5781220cca329df97b3df578363747e04259 # v2
+    uses: cplieger/ci/.github/workflows/security-scan.yaml@bcbabc5729e5c3cf3b660867e8fce40263f06a28 # v2

cliff.toml

@@ -63,6 +63,16 @@ exclude_paths = [
   ".gitignore",
   ".gitattributes",
   ".editorconfig",
+  # punused adjudications: the repo-owned whitelist the go-ci unused-export gate
+  # reads. Dev-only, never in an artifact, and an adjudication-only commit ships
+  # nothing — but it is the one dotfile here a `refactor:`-typed commit plausibly
+  # touches alone (deleting dead code and recording the survivors is one change;
+  # recording them alone is the follow-up), and `refactor:` is a RELEASING type.
+  # `**/` not bare: go-ci reads this file relative to its working-directory, so a
+  # nested Go module's copy lives at <dir>/.punused-ignore and the root-anchored
+  # form would miss it (measured on the pinned cliff v2.13.1 — bare excludes the
+  # root file only, `**/` excludes both, and a real code commit still bumps).
+  "**/.punused-ignore",
 ]
 
 commit_parsers = [

tests/image-smoke.sh

@@ -36,6 +36,12 @@
 #                    wait shares the SMOKE_TIMEOUT deadline: the container must
 #                    be healthy AND have logged the pattern before it expires.
 #
+# A .conf that creates host state of its own (a `mktemp -d` fixture dir, a
+# generated key) overrides the smoke_cleanup() function to remove it; the
+# harness's EXIT trap calls it after removing the container, so acquisition and
+# release live side by side in the .conf and every invocation - local or CI -
+# leaves nothing behind.
+#
 # The harness also sets $SMOKE_DIR (this script's own absolute directory)
 # before sourcing the .conf, so an app that needs a config/fixture file on disk
 # can bind-mount a committed fixture dir, e.g.:
@@ -55,12 +61,13 @@ SMOKE_APP_NAME=""
 SMOKE_TIMEOUT=""
 SMOKE_RUN_ARGS=""
 SMOKE_LOG_PATTERN=""
-# Initialised because both post-loop verdicts read it, and the wait loop's body is
-# skippable: SMOKE_TIMEOUT="0" passes the non-negative-integer check above, so the
-# deadline can already have passed at the first test and `status` would be unbound
-# under set -u. An empty value reports honestly ("last status: ") instead of dying
-# with an unbound-variable error that names nothing useful.
-status=""
+# Default app cleanup hook: a .conf that creates host state overrides it. Defined
+# BEFORE the source so the EXIT trap can always call it, and so a .conf that
+# creates nothing needs no boilerplate.
+# shellcheck disable=SC2329  # invoked indirectly via the EXIT trap's cleanup()
+smoke_cleanup() {
+  :
+}
 CONF="$SMOKE_DIR/image-smoke.conf"
 if [ -f "$CONF" ]; then
   # shellcheck disable=SC1090  # per-app config path, resolved at runtime
@@ -90,6 +97,9 @@ cleanup() {
     docker inspect --format '{{ if .State.Health }}{{ range .State.Health.Log }}exit={{ .ExitCode }}: {{ .Output }}{{ end }}{{ end }}' "$NAME" 2>/dev/null >&2 || true
   fi
   docker rm -f "$NAME" >/dev/null 2>&1 || true
+  # The app's own fixture teardown, after the container that consumed it is gone.
+  # Never allowed to change the run's verdict.
+  smoke_cleanup || true
 }
 trap cleanup EXIT
 
@@ -99,6 +109,8 @@ docker run -d --name "$NAME" $SMOKE_RUN_ARGS "$IMG" >/dev/null
 
 start=$(date +%s)
 deadline=$((start + TIMEOUT))
+# Pre-set so both post-loop verdicts have a state to name: a SMOKE_TIMEOUT of 0
+# skips the loop body entirely.
 status=starting
 while [ "$(date +%s)" -lt "$deadline" ]; do
   # Fail fast on an early exit: poll .State.Running before the health status so