From 38be22f745f45816963dde4deaa6a6da72c8c4f2 Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Sun, 30 Aug 2026 17:11:16 +0000
Subject: [PATCH] [patch] Follow LibOps runtime main tags

---
 .github/workflows/github-release.yaml         |  2 +-
 Makefile                                      |  9 +--
 ci/source-trust-contract.sh                   | 64 -------------------
 modules/gcp/main.tf                           |  2 +-
 .../data/libops-internal/docker-compose.yaml  |  4 +-
 5 files changed, 7 insertions(+), 74 deletions(-)
 delete mode 100755 ci/source-trust-contract.sh

diff --git a/.github/workflows/github-release.yaml b/.github/workflows/github-release.yaml
index 1416b8e..e7103bb 100644
--- a/.github/workflows/github-release.yaml
+++ b/.github/workflows/github-release.yaml
@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: libops/.github/.github/workflows/bump-release.yaml@8dfaf9c854df71d9bbffde48c5676ff07c543c51
+    uses: libops/.github/.github/workflows/bump-release.yaml@main
     permissions:
       contents: write
       actions: write
diff --git a/Makefile b/Makefile
index e494ce5..2f32efa 100644
--- a/Makefile
+++ b/Makefile
@@ -3,7 +3,7 @@
 .PHONY: vault-runtime-contract
 .PHONY: managed-artifact-contract config-management-input-contract systemd-contract
 .PHONY: sitectl-version-contract
-.PHONY: host-runtime-security source-trust-contract
+.PHONY: host-runtime-security
 .PHONY: template-version-contract rollout-parity-contract artifact-install-contract
 .PHONY: cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract
 .PHONY: go-fmt-check go-vet go-contracts cloud-compose-ci
@@ -39,9 +39,9 @@ export CLOUD_COMPOSE_CI_BIN
 GO_MODULE_FILES := $(wildcard go.mod go.sum)
 GO_SOURCES := $(shell find cmd internal -type f -name '*.go')
 
-lint: terraform-fmt actionlint shell-lint host-runtime-security application-env-contract sitectl-host-runtime-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract source-trust-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract sitectl-version-contract template-version-contract rollout-parity-contract artifact-install-contract terraform-validate terraform-docs-check
+lint: terraform-fmt actionlint shell-lint host-runtime-security application-env-contract sitectl-host-runtime-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract sitectl-version-contract template-version-contract rollout-parity-contract artifact-install-contract terraform-validate terraform-docs-check
 
-lint-check: terraform-fmt-check actionlint shell-lint host-runtime-security application-env-contract sitectl-host-runtime-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract source-trust-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract sitectl-version-contract template-version-contract rollout-parity-contract artifact-install-contract terraform-validate terraform-docs-check
+lint-check: terraform-fmt-check actionlint shell-lint host-runtime-security application-env-contract sitectl-host-runtime-contract vault-runtime-contract managed-artifact-contract config-management-input-contract systemd-contract cloud-smoke-cleanup-contract hosted-cleanup-retry-contract gcp-upgrade-smoke-contract sitectl-version-contract template-version-contract rollout-parity-contract artifact-install-contract terraform-validate terraform-docs-check
 
 actionlint:
 	go run github.com/rhysd/actionlint/cmd/actionlint@$(ACTIONLINT_VERSION)
@@ -104,9 +104,6 @@ template-version-contract rollout-parity-contract: go-contracts
 host-runtime-security:
 	bash ci/host-runtime-security.sh
 
-source-trust-contract:
-	bash ci/source-trust-contract.sh
-
 cloud-smoke-cleanup-contract: go-contracts
 
 cloud-compose-ci: $(CLOUD_COMPOSE_CI_BIN)
diff --git a/ci/source-trust-contract.sh b/ci/source-trust-contract.sh
deleted file mode 100755
index a0f5f93..0000000
--- a/ci/source-trust-contract.sh
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-fail() {
-  echo "source trust contract: $*" >&2
-  exit 1
-}
-
-debian_installer="$repo_root/rootfs/home/cloud-compose/install-dependencies-debian.sh"
-cos_installer="$repo_root/rootfs/home/cloud-compose/install-dependencies-cos.sh"
-host_conf="$repo_root/rootfs/home/cloud-compose/host-conf.sh"
-installer="$repo_root/rootfs/etc/cloud-compose/libexec/install-rootfs.py"
-linux_runtime="$repo_root/modules/linux-vm-runtime/main.tf"
-linux_cloud_init="$repo_root/modules/linux-vm-runtime/templates/cloud-init.yml"
-gcp_module="$repo_root/modules/gcp/main.tf"
-gcp_cloud_init="$repo_root/templates/cloud-init.yml"
-
-grep -Eq '^[[:space:]]+openssl([[:space:]\\]|$)' "$debian_installer" ||
-  fail "Debian bootstrap does not install openssl"
-grep -Fq 'command -v openssl' "$cos_installer" ||
-  fail "COS bootstrap does not require openssl"
-
-dependencies_line="$(grep -nF 'bash /home/cloud-compose/install-dependencies.sh' "$host_conf" | cut -d: -f1)"
-managed_runtime_line="$(grep -nF '"$sitectl" host runtime install' "$host_conf" | cut -d: -f1)"
-[[ -n "$dependencies_line" && -n "$managed_runtime_line" && "$dependencies_line" -lt "$managed_runtime_line" ]] ||
-  fail "verified sitectl installation must follow OS dependency installation"
-
-grep -Fq 'libops/.github/.github/workflows/bump-release.yaml@8dfaf9c854df71d9bbffde48c5676ff07c543c51' \
-  "$repo_root/.github/workflows/github-release.yaml" ||
-  fail "write-capable release workflow is not pinned"
-grep -Eq 'source = "https://github\.com/libops/terraform-cloudrun-v2/archive/[0-9a-f]{40}\.zip//terraform-cloudrun-v2-[0-9a-f]{40}"' \
-  "$gcp_module" || fail "GCP Terraform dependency is not pinned to a commit"
-
-for module in "$linux_runtime" "$gcp_module"; do
-  grep -Fq 'rootfs_bundle_content = jsonencode({' "$module" ||
-    fail "$module does not build the checked rootfs bundle"
-  grep -Fq 'base64gzip(local.rootfs_bundle_content)' "$module" ||
-    fail "$module does not compress the checked rootfs bundle"
-done
-for template in "$linux_cloud_init" "$gcp_cloud_init"; do
-  grep -Fq '/var/lib/cloud-compose/bootstrap/install-rootfs.py' "$template" ||
-    fail "$template does not install the checked rootfs installer"
-  grep -Fq '/var/lib/cloud-compose/bootstrap/rootfs.json' "$template" ||
-    fail "$template does not install the checked rootfs bundle"
-done
-
-grep -Fq 'SAFE_PATH = re.compile' "$installer" ||
-  fail "rootfs installer does not constrain paths"
-grep -Fq 'if any(part in ("", ".", "..")' "$installer" ||
-  fail "rootfs installer does not reject path traversal"
-grep -Fq 'stat.S_ISLNK' "$installer" ||
-  fail "rootfs installer does not reject symlinks"
-grep -Fq 'os.replace(temporary, path)' "$installer" ||
-  fail "rootfs installer does not publish files atomically"
-
-archive_variable='rootfs''_archive'
-archive_program='rootfs''-archive'
-if rg -n -i "${archive_variable}|${archive_program}" "$repo_root" \
-  --hidden --glob '!**/.terraform/**' --glob '!**/.git/**' >/dev/null; then
-  fail "retired rootfs transport machinery remains"
-fi
diff --git a/modules/gcp/main.tf b/modules/gcp/main.tf
index f4f174c..f302002 100644
--- a/modules/gcp/main.tf
+++ b/modules/gcp/main.tf
@@ -1149,7 +1149,7 @@ resource "google_service_account" "ppb" {
 
 module "ppb" {
   count  = var.power_management_enabled ? 1 : 0
-  source = "https://github.com/libops/terraform-cloudrun-v2/archive/8415816cd559f365d7ddeee9ed3d3a88665cd824.zip//terraform-cloudrun-v2-8415816cd559f365d7ddeee9ed3d3a88665cd824"
+  source = "https://github.com/libops/terraform-cloudrun-v2/archive/refs/heads/main.zip//terraform-cloudrun-v2-main"
 
   name                         = var.name
   project                      = var.project_id
diff --git a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
index 21579cc..535d661 100644
--- a/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
+++ b/rootfs/mnt/disks/data/libops-internal/docker-compose.yaml
@@ -4,7 +4,7 @@ services:
   lightsout:
     profiles:
       - lightsout
-    image: ghcr.io/libops/lightsout:main@sha256:4d38ac380c86514d72efbcce0af9ea8ffd7ff86e97abea3d0b3c946cf204eaae
+    image: ghcr.io/libops/lightsout:main
     ports:
       - "8808:8808"
     networks:
@@ -40,7 +40,7 @@ services:
       - /mnt/disks/data/docker/:/var/lib/docker:ro
       - /dev/disk/:/dev/disk:ro
   cap:
-    image: ghcr.io/libops/cap:main@sha256:c9d6a6c2ded2d0a72ceff382fd71da9cd161c17c071319b45270b07c0f54a5ed
+    image: ghcr.io/libops/cap:main
     command: ["/app/binary"]
     networks:
       - internal