Project Bluefin

Participation

Human and automated contributions with current contributors.

Show the numbers

Human and automation activity data for September 2026 UTC (2026-09-01 to 2026-09-30)

Label	Human	Automation
Report period	780	420

🏆 Hive Leaderboard

Hive Leaderboard: Community Heroes

Celebrating our top community builders across the Project Bluefin factory

RankContributorImpactProjectsMilestone

#01@castrojo272 PRscommondakotatestsuite+7Top Hero#02@hanthor110 PRscommontestsuiteserver+4High Velocity#03@kylerankin67 PRscommontestsuiteserver+6High Velocity#04@mrbobbytables65 PRstestsuiteserveractions+4High Velocity#05@Danathar59 PRscommondakotatestsuite+7High Velocity#06@ahmedadan47 PRscommondakotadocumentationHigh Velocity#07@mendezr32 PRscommontestsuiteserver+5New Light#08@jeefy29 PRsserverNew Light#09@Siddhj220616 PRscommonactionsfinpilotHigh Velocity#10@repires15 PRscommontestsuiteactions+3High Velocity#11@buggtb14 PRscommontestsuiteactions+2New Light#12@dtg0110013 PRsserveractionsdocumentation+1High Velocity#13@sramkrishna12 PRscommontestsuiteactions+2New Light#14@arteeh5 PRscommonserverutah-packagesNew Light#15@KiKaraage5 PRscommonactionsutahHigh Velocity#16@HuntedRaven73 PRscommonactionsutahCross-Fleet#17@clubanderson3 PRscommonutah-packages#18@eltorrero3 PRscommonactions#19@TB5162 PRsserverdocumentationNew Light#20@bronson1 PRserverNew Light

✨

Welcome New Lights (11)

First-time guardians who made their mark in the factory this month.

@mendezr@sramkrishna@kronikpillow@buggtb@arteeh@xHope-tech@ericcurtin@KOTONEX@jeefy@bronson@TB516

Release details remain on the canonical /changelogs surface.

Completed work​

• fix(ci): report required checks on docs-only PRs by @​Danathar in #1181
• docs(secrets-policy): record Cloudflare secrets as provisioned by @​clubanderson in #1275
• feat(wallpaper): ship original looping movie for Hidamari by @​mendezr in #1207
• refactor: remove produced-but-unconsumed nvidia overlay by @​mendezr in #1263
• docs(ci-tooling): record Renovate fork processing for the printer forks by @​sramkrishna in #1259
• docs(release-promotion): record printer testing-to-stable promotion proof by @​kylerankin in #1257
• feat(brew): update opencode to the v2 formula by @​kronikpillow in #1270
• docs(ci-pitfalls): correct create-github-app-token owner/repositories scoping by @​castrojo in #1269
• fix(chairlift): refresh vendored desktop entry and icons to v26.09.0-alpha.2 by @​clubanderson in #1274
• docs(chairlift): fix broken brew-lifecycle doc reference in config.yml by @​buggtb in #1273
• fix: align ChairLift config and ship GSettings schemas by @​mendezr in #1265
• fix(nvidia): pin suspend notifiers so sleep is not vetoed by @​mendezr in #1176
• fix(brew): comment out kcl, use upstream kpt, remove aurora-wp by @​KiKaraage in #1131
• feat(wallpaper): add Damask first-run setup hook and non-destructive defaults by @​repires in #1186
• fix: reconcile inert .github Renovate configuration by @​repires in #1183
• feat(damask): ship flatpak overrides and background systemd service by @​repires in #1187
• feat(chairlift): add wallpaper slideshow and video wallpaper brew bundles by @​sramkrishna in #1185
• ci: run all maintained unit suites in CI by @​arteeh in #1249
• feat(testing): add a hardware-free eSCL scanner fixture by @​sramkrishna in #1225
• docs(contributing): add per-repo reviewer coverage map with refresh procedure by @​mendezr in #1248
• docs: inventory printer and scanner driver projects by @​arteeh in #1221
• docs: record printer application upstream source baseline by @​buggtb in #1251
• docs(skills): track PAPPL scanning API upstream status and ownership boundary by @​buggtb in #1218
• docs(printer-apps): add release-contract evidence matrix by @​buggtb in #1222
• docs(ci-tooling): correct stale claim about dockerfile manager and COPY --from by @​buggtb in #1255
• docs(skills): correct renovate versioned-binary tracking wording by @​mendezr in #1250
• docs: assess native HP PCL app against HPLIP OCI coverage by @​buggtb in #1236
• docs: evaluate LPrint v1.4.0 as FSDK OCI label-printer appliance by @​kylerankin in #1235
• docs: correct reusable lifecycle automation ownership (bonedigger, not actions) by @​buggtb in #1227
• docs(scanner): evaluate scanApp POC and pappl-retrofit scanning feasibility by @​buggtb in #1220
• docs: evaluate legacy SANE scanning appliance without claiming driverless parity by @​buggtb in #1219
• docs(contributing): add self-collision preflight draft for intra-lane duplicate PRs by @​sramkrishna in #1201
• fix(audio): make Bluetooth auto-switch opt-in instead of default by @​mendezr in #1179
• feat(brew): remove RamaLama from Bluefin AI tools bundle by @​kylerankin in #1204
• fix: honor NO_COLOR in local override output by @​Danathar in #1190
• fix: require review for GitHub Actions minor/patch updates by @​Danathar in #1146
• ci: run the suite-registration drift gate on every PR by @​kylerankin in #1192
• feat: WSL/container machine equivalent developer environment via Lima by @​repires in #1175
• fix(systemd): remove local-fs ordering cycle in rechunker-group-fix by @​kylerankin in #1208
• feat(countme): add dakota-scoped client and systemd units by @​castrojo in #1154
• feat(bazaar): Sept 2026 curation update, 7 new recs by @​KiKaraage in #1173
• fix: empty hooks directory made setup services exit 127 by @​kylerankin in #1193
• ci: block unpinned git checkouts in Containerfile builder stages by @​mendezr in #1178
• feat: Super+E should open a new Nautilus window on every press by @​repires in #1184
• chore: update motd + config by @​theMimolet in #1077
• fix(brew): drop tremor-runtime, removed from Homebrew by @​castrojo in #1206
• fix(countme): retry Dakota once per UTC week by @​castrojo in #1203
• fix(chairlift): track rebranded projectbluefin/chairlift release by @​eltorrero in #1121
• fix(apps): pin and sha256-verify OpenTabletDriver install fetches by @​mendezr in #1198
• docs(contributing): add agent-lane-throttle.md — demand-side throttle for the hold-gate queue by @​sramkrishna in #1197
• docs(contributing): add triage-sla.md — 14-day first-response SLA proposal for human-authored issues by @​mendezr in #1195
• docs(skills): record image-identity ownership decision — docs/skills/image-identity.md by @​sramkrishna in #1191
• docs: add systemd-homed-by-default decision record by @​eltorrero in #1200
• docs(bluespeed): mark bluefin-mcp as archived in the specification by @​kylerankin in #1199
• docs(contributing): add hold-gate PR queue prioritization rubric by @​repires in #1188
• docs: correct secrets-policy enforcement claim and add credential preflight rule by @​sramkrishna in #1180
• docs: document downstream label subsets separate from core factory catalog by @​mendezr in #1177
• docs(skills): widen category enum to include platform and product by @​repires in #1182
• docs(factory): ban COMMENT-only PR reviews and comment spam by @​castrojo in #1174
• fix(brew): preserve user-owned preinstall packages by @​Danathar in #1109
• fix(wireplumber): disable IR sensor on Kingcome hybrid webcam (2b7e:55c0) by @​castrojo in #1119
• fix(cli): replace atuin and bash-preexec with starship and add tests by @​castrojo in #1113
• docs(skills): maintainer-driven tool actions and duplicate-cluster resolution by @​castrojo in #970
• docs: fix grammatical and readability problems README.md by @​xHope-tech in #1017
• feat(bazaar): modernize curated layout and add Flathub IDE host integration hooks by @​castrojo in #1155
• fix(bling): ship working ujust completions for bash/zsh/fish by @​KiKaraage in #1129
• ci(actionlint): allow the ubuntu-26.04 runner labels by @​Danathar in #1151
• fix: add consistent bootc sudo policy by @​castrojo in #932
• fix(sec): ship Sigstore trust materials (Fulcio root + Rekor key) by @​hanthor in #933
• feat: add llmman to ai-tools Brewfile by @​ericcurtin in #1097
• fix(brew): allow dedicated ChairLift migration by @​ahmedadan in #1100
• fix(bling): rearm bash-preexec DEBUG trap on each prompt by @​castrojo in #943
• fix(brew): replace invalid brew tap --trust with brew tap + brew trust by @​castrojo in #941
• test: isolate UWELCOME_SHOWN in test_motd_integration.bats by @​castrojo in #1088
• refactor(just): move 00-entry.just to shared with optional imports by @​Siddhj2206 in #1042
• fix(flatpak): correct metered check in appstream refresh service by @​HuntedRaven7 in #1035
• fix: restore native recipes without bluefinctl by @​ahmedadan in #1083
• fix: resolve cask references and expose validation errors by @​ahmedadan in #1084
• fix(uwelcome): skip greeting for root and dedupe chained shells by @​ahmedadan in #1059
• fix(pages): dashboard CNAME qa.projectbluefin.io shadowed by redirect by @​kylerankin in #902
• fix(gate): let non-Bluefin images skip Bluefin-only scenarios, tolerate GNOME 51 display key by @​hanthor in #900
• fix(smoke): notify sandbox before app-availability early skips by @​hanthor in #899
• fix(e2e): allow unsafe-mode test extension on GNOME 51 shells by @​hanthor in #898
• fix(e2e): enable sshd via kernel arg so image presets cannot undo it by @​hanthor in #895
• fix(bazzite): mark extension 'is enabled' scenarios pending on state=6 regression by @​buggtb in #888
• refactor: remove unconsumed DEFAULT_SLA and SLA_STRICT from timing helper by @​repires in #882
• fix(renovate): restrict automerge to immutable-ref housekeeping by @​kylerankin in #886
• chore(scripts): remove dead parse_results script and tests by @​repires in #884
• docs(coverage): sync qa-review recount totals with suite-map snapshot by @​repires in #881
• chore(deps): update github-actions (non-major) by @​castrojo in #879
• docs(coverage): sync qa-review totals, add installer matrix row, fix flatpak gap by @​castrojo in #880
• test(smoke): comprehensive AT-SPI, stability, and presence coverage for Dakota GNOME extensions by @​castrojo in #808
• docs: remove ghost-lab dependencies and gate requirements by @​castrojo in #878
• chore: remove bluefinctl test coverage by @​castrojo in #822
• fix(shared): route AT-SPI tree dump through resolve_results_dir by @​kylerankin in #825
• fix(justfile): route results parsing through e2e_summary.py by @​mendezr in #873
• docs(software): audit the @future scenarios blocking GNOME 51 re-validation by @​sramkrishna in #877
• test(smoke): skip @vm_only scenarios in container lanes by @​castrojo in #740
• test(lifecycle): add settled-deployment barrier and activate bootc pin scenario by @​mrbobbytables in #837
• [sec-check] fix: declare top-level permissions: {} in e2e.yml by @​Danathar in #813
• refactor(ssh): Phase 2 — route dx/flatcar/kde-smoke/software/vanilla-gnome onto ssh_config.ssh_argv() by @​mrbobbytables in #790
• fix(gnome-e2e): source the results summary from scripts/e2e_summary (#797) by @​mendezr in #819
• docs(gnome): trim duplicate blank line to satisfy 500-line SKILL.md cap by @​Danathar in #869
• refactor: fold duplicated _first_value into shared ssh_config by @​mrbobbytables in #787
• docs(ci): make GNOME version string neutral across e2e summary and docs by @​mendezr in #854
• test(vanilla-gnome): add GNOME 51 reduced-motion and focus-ring gsettings round-trips by @​kylerankin in #851
• test(common): activate podman user socket scenario and track immutable status blockers by @​mrbobbytables in #852
• test(smoke): audit GNOME 50 workarounds against GNOME 51, update gnome.md by @​kylerankin in #848
• fix(ci): unify image-slug grammar across e2e workflow and artifact tags by @​mrbobbytables in #865
• ci: restore migration-target and extra-tags inputs to e2e.yml by @​kylerankin in #867
• test(software): re-anchor @future scenarios from closed #176 to #847 by @​mrbobbytables in #849
• test(vanilla-gnome): GNOME 51 readiness — Shell version canary by @​mrbobbytables in #864
• docs: align AGENTS.md and contributing/SKILL.md on skill-update gate by @​mrbobbytables in #862
• test(smoke): suppress session idle-lock in smoke setup to unblock GOA provider-list by @​mrbobbytables in #850
• test(quality): unit coverage for scripts/generate_skill_index.py by @​mrbobbytables in #788
• docs(scanner): fix malformed unit-test documentation block by @​mrbobbytables in #785
• fix(e2e): scope metadata artifacts by image by @​castrojo in #856
• fix(smoke): ignore Nvidia CDI failures in QEMU by @​castrojo in #855
• fix(e2e): stabilize Firefox accessibility workflow by @​castrojo in #853
• fix(e2e): robust toggle-updates probe, storage service lifecycle, and Firefox window lookup by @​castrojo in #792
• feat(nvidia): NVIDIA sysext skill and driver release tracking by @​dtg01100 in #326
• ci(build): run boot-test and release-dry-run when kernel-cache is skipped by @​jeefy in #328
• fix(initrd): verify the per-node Ignition config before applying it by @​kylerankin in #285
• fix(installer): keep console install failures visible instead of halting by @​dtg01100 in #321
• feat(nvidia): deliver the driver and toolkit sysexts to nodes by @​jeefy in #319
• fix(os): ship /etc/protocols and /etc/services (IANA netdb) for NFSv3 by @​jeefy in #317
• fix(sysupdate): ship the trust keyring in the vendor image by @​arteeh in #312
• feat(nvidia): container toolkit sysext (CDI) by @​jeefy in #304
• feat(nvidia): open-kernel-module driver sysext (nvidia-open-595) by @​jeefy in #305
• fix(kernel-cache): verify the whole tarball before restoring it by @​castrojo in #315
• ci(build): key-free kernel cache in ghcr.io for release builds by @​castrojo in #314
• ci(build): validate pull requests, build the image nightly, on main and on demand by @​castrojo in #313
• feat(installer): carry stick credentials to the installed disk; developer-mode admin user by @​castrojo in #300
• fix(security): clear group/other write from image paths; repair /etc on existing installs by @​castrojo in #303
• docs: sync the Booty story with jeefy/booty main by @​jeefy in #298
• feat(os): NFS client (nfs-utils + rpcbind, client-only) in the base image by @​jeefy in #295
• fix(installer): quiet vfat exec-bit repart warnings on diskless boot path by @​kylerankin in #283
• fix(installer): accurate login banner and first-boot password docs by @​castrojo in #297
• fix(installer): ask for a root password on the installed disk's first boot by @​castrojo in #293
• ci(build): queue main runs instead of cancelling them; upload installer logs by @​jeefy in #292
• ci(track-binaries): refresh amd64 and arm64 pins together, with tests by @​jeefy in #288
• build: drop FSDK os-release from the build sandbox and its patches by @​castrojo in #291
• fix(installer): no keymap or erase questions, reboot when done by @​castrojo in #290
• docs: follow-ups deferred from #276 by @​jeefy in #289
• ci: boot-test the offline USB installer end to end by @​jeefy in #277
• test: assert parsed properties instead of file text; no silent skips in CI by @​jeefy in #278
• build: reproducible image assembly, key-set safety, patch docs by @​jeefy in #281
• build: drop the gnome-build-meta junction by @​jeefy in #280
• refactor: shared sysext packing recipe, arm64 binary pins, base-image cleanups by @​jeefy in #279
• ci(release): dry-run the publish path on pull requests; attest provenance and publish an SBOM by @​jeefy in #269
• ci: boot-test tamper refusal, HTTP boot, Ignition and A/B rollback; skip image builds for docs-only changes by @​jeefy in #270
• fix(installer): boot offline, allow credential overrides, quiet repart warnings by @​castrojo in #268
• feat(update): automatic updates with a Kubernetes interlock, a boot health gate and a diskless update signal by @​jeefy in #271
• feat(initrd): explain diskless boot failures and ignored Ignition kargs by @​jeefy in #273
• docs: accuracy pass after the FSDK rebase by @​jeefy in #276
• ci: track patch releases of upstream binaries (Kubernetes, containerd, runc, CNI, k0s, ORAS) by @​jeefy in #272
• fix(security): ship root locked; provision access per node by @​jeefy in #275
• feat(installer): offline USB installer image booting into systemd-sysinstall by @​castrojo in #264
• fix(ci): install ORAS 1.3.4 by URL and checksum by @​castrojo in #266
• feat!: FSDK-composed OS with a signed, diskless-first boot chain by @​jeefy in #262
• Remove heading from README.md by @​castrojo in #261
• docs: add theme-adaptive wordmark to README by @​castrojo in #260
• feat(installer): opt-in network credentials pull (inst.creds_url / inst.creds_sha256) for PXE installs by @​jeefy in #253
• fix(ddi): restore the setuid/setgid bits Flatcar ships on sudo, su, passwd, mount, … by @​jeefy in #255
• fix(installer): actually wait for the network before the DDI download by @​jeefy in #252
• fix(installer): stage the network DDI in /dev/shm and check free space before decompressing by @​jeefy in #251
• fix(creds): apply firstboot.* credentials without systemd-firstboot by @​jeefy in #254
• fix(installer): rewrite the network DDI repart override without sed by @​jeefy in #250
• fix(installer): bare-metal USB install consolidation, preset ordering, and OVMF boot test by @​castrojo in #243
• fix(fsdk): disable tests in glib-stage1 bootstrap by @​castrojo in #51
• docs(arch): scope FSDK hard rule to installer by @​castrojo in #133
• chore(ci): pin runners to ubuntu-26.04 by @​castrojo in #237
• fix(kiosk): bridge guest loopback proxy via SSH port forwarding for QEMU by @​mrbobbytables in #202
• refactor: switch OS payload to Flatcar base, drop displaced FSDK components by @​kylerankin in #132
• refactor(arch): split release-version into installer and Flatcar axes by @​mrbobbytables in #136
• fix(flatcar): use flatcar-kernel-container-sha256 in flatcar-usr.bst by @​castrojo in #236
• feat(flatcar): add flatcar-usr.bst importing Flatcar /usr as the OS payload base by @​mrbobbytables in #140
• build: os-base option to compare FSDK payload against Flatcar reference by @​kylerankin in #163
• feat(installer): add opt-in PXE network DDI pull by @​kylerankin in #229
• test(installer): behavioural contract for the QEMU boot-proof readiness gate by @​Danathar in #219
• fix(k0s): pin argocd image by digest and upgrade past EOL v2.12.3 by @​kylerankin in #212
• fix(kiosk): console shows live local cluster state on first boot by @​kylerankin in #214
• arch: make include/flatcar.yml the single source of truth for Flatcar pins by @​kylerankin in #143
• feat(creds): extend systemd-creds provisioning to SSH keys, network, firstboot, and TPM2 by @​mrbobbytables in #221
• revert: remove unapproved appliance identity design (#208) by @​castrojo in #235
• fix(installer): harden flash-installer with refusal guards, write verification, and GPT backup relocation by @​castrojo in #225
• chore(renovate): disable the homebrew manager for binary-asset formulae by @​castrojo in #211
• ci: include scripts/** in unit-tests workflow paths filter by @​mendezr in #234
• fix(justfile): probe install-vm kiosk readiness from inside the guest (rebased) by @​castrojo in #227
• fix(installer): hard preflight abort when bluefin-installer-data is absent by @​castrojo in #224
• fix(boot): resolve QEMU installer boot deadlock and console readiness probe by @​mrbobbytables in #220
• fix(ci): pin just tool version in CI workflows by @​kylerankin in #190
• ci: expand unit-tests workflow paths trigger by @​mrbobbytables in #189
• fix(renovate): match the freedesktop-sdk series the junction actually tracks by @​hanthor in #84
• ci: land #190, #189 and #84 with the build.yml conflict resolved by @​castrojo in #217
• fix(ci): move junction ref tracking out of the pull_request path by @​castrojo in #180
• feat(flatcar): record container runtime parity by @​castrojo in #192
• feat(arch): produce Flatcar-to-FSDK version parity matrix (#142) by @​mrbobbytables in #184
• test(build-depends): lock in os-countme curl+jq FSDK paths by @​kylerankin in #122
• fix(installer): bound root-a partition to guarantee room for var by @​mrbobbytables in #207
• fix(test): preserve installer-created var partition by @​castrojo in #157
• ci: update installer evidence workflow pin by @​castrojo in #156
• fix(ci): support repart on hosted runners by @​castrojo in #152
• ci: update installer test workflow pin by @​castrojo in #151
• ci: run installer smoke through shared QEMU workflow by @​castrojo in #149
• Add kmod component and update depmod path by @​bronson in #146
• docs: mandate distributed BuildStream builds on ghost cluster by @​castrojo in #121
• fix(installer): fix kernel module extraction and probe USB storage drivers by @​castrojo in #120
• fix(e2e): support self-signed TLS certificates in readiness checks by @​castrojo in #118
• feat(lima): end-to-end Lima VM orchestration and automated browser login by @​castrojo in #117
• perf(kiosk): set KAGENTI_CONTROLLER_URL="none" in kc-agent gate command by @​mrbobbytables in #114
• feat(kiosk): forward kubernetes API port 6443 in install-vm by @​castrojo in #107
• feat(countme): ship the shared bluefin-countme reporter by @​castrojo in #94
• fix(kubestellar): correct container image tags and names in k0s manifests by @​kylerankin in #103
• fix(k0s): generate kubeflex postgres password at first boot instead of hardcoding it by @​kylerankin in #102
• fix(ci): restore dropped k0s sysext copy into dist/release/ by @​castrojo in #93
• feat(kernel): add Flatcar LTS kernel & ZFS sysext, export PXE release assets by @​castrojo in #92
• fix(installer): show interactive UI on the local display by @​TB516 in #79
• fix(k0s): complete first-boot activation and console readiness by @​castrojo in #63
• fix(build): prepare alpha release validation and sysext cleanup by @​castrojo in #59
• fix(fsdk): create uninstalled libappstream symlinks in appstream-minimal by @​castrojo in #58
• fix(build): add SONAME symlinks and LD_LIBRARY_PATH for gdk-pixbuf by @​castrojo in #56
• fix(fsdk): resolve libgirepository SONAME symlinks in gobject-introspection-base by @​castrojo in #54
• fix(chunka): pin chunkah's build clock so an unchanged rebuild keeps its digest by @​dtg01100 in #592
• chore: bump testsuite e2e pin for Utah gate fixes by @​hanthor in #588
• chore: bump testsuite e2e pin for GNOME 51 + early-skip fixes by @​hanthor in #587
• chore: bump testsuite e2e pin to include preset-proof sshd enablement by @​hanthor in #584
• fix(factory-health): dedupe open alerts by author by @​repires in #577
• fix(factory-health): close recovered alerts so dedupe stops muting pipelines by @​Danathar in #550
• ci(unit-tests): add missing workflow paths for tested guarded workflows by @​buggtb in #578
• fix(ci): annotate reusable-thin-caller-gate and drop hardcoded count in test by @​castrojo in #573
• fix(factory-health): require a minimum sample before alerting by @​Danathar in #560
• ci(promote-squash): let callers say the promotion PR is merged by a human by @​Danathar in #566
• fix(factory-health): fail the run when factory alerts are misrouted by @​Danathar in #564
• fix(workflows): stop PR-controlled CHUNKAH_VERSION reaching shell in vendor-chunka-files by @​sramkrishna in #570
• fix(release): normalize caller-supplied image reference by @​Siddhj2206 in #524
• feat(ci): annotate reusable workflows with required token type by @​mrbobbytables in #547
• ci(unit-tests): cover reusable-renovate-automerge.yml in the paths filter by @​Danathar in #553
• feat(reusable-build): allow testing-stream builds to opt into rechunking and SBOM by @​mendezr in #557
• fix(factory-health): bound the run fetch by the window, not a run count by @​Danathar in #551
• feat(ci): enforce thin-caller gate in consumer repos (issue #546) by @​Danathar in #554
• fix(ci): mint app token for renovate auto-merge wiring check by @​Danathar in #552
• docs(skills): add merge-governance and document the empty-commit consumer PR by @​castrojo in #537
• ci(unit-tests): cover ghcr-cleanup.yml in the paths filter by @​castrojo in #534
• ci(actionlint): make the required check reachable on PRs and merge groups by @​castrojo in #536
• fix(setup-runner): support ubuntu-26.04 runners and skip resolute apt source (#541) by @​castrojo in #549
• ci(unit-tests): cover guarded release workflows in paths filter by @​kylerankin in #532
• ci: test the Renovate auto-merge merge/outcome step (issue #403) by @​mendezr in #516
• test(bootc-build): add coverage and drift guards for ghcr-cleanup action by @​mrbobbytables in #511
• fix(promotion): treat missing E2E as pending by @​castrojo in #527
• fix(promotion): gate merge status on evidence by @​castrojo in #526
• fix(release): harden promotion orchestration by @​castrojo in #525
• fix(promotion): trust only Actions E2E status by @​castrojo in #521
• fix(promotion): forward E2E status context by @​castrojo in #519
• fix(promotion): bind E2E evidence to source commit by @​castrojo in #515
• fix(promotion): gate queue enrollment on verification by @​castrojo in #513
• refactor(ci): narrow installer artifact contract by @​castrojo in #506
• fix(ci): upload only QEMU serial logs by @​castrojo in #505
• fix(ci): stage QEMU failure evidence by @​castrojo in #504
• fix(ci): grant runner access to KVM device by @​castrojo in #502
• feat(ci): add server installer QEMU workflow by @​castrojo in #501
• fix(renovate): target caller repository by @​Siddhj2206 in #460
• fix(release): normalize OCI registry namespaces by @​Siddhj2206 in #461
• fix(chunka): create config temp file as root to avoid protected_regular denial by @​Siddhj2206 in #497
• ci: add scheduled Renovate auto-merge wiring assertion (#403) by @​kylerankin in #498
• arch: enforce thin-caller size gate (issue #411) by @​mendezr in #472
• fix(sign-and-publish): mitigate SBOM exceeding GitHub Attestations 16MB limit (fixes #480) by @​mrbobbytables in #484
• fix(pkg-cadence): open a PR instead of pushing to main by @​kylerankin in #476
• fix(cadence): pass app credentials to reusable workflow (fixes #425) by @​mrbobbytables in #492
• chore(ci): narrow MergeRaptor app token permissions to what's needed (fixes #421) by @​mendezr in #478
• docs(supply-chain): record cosign install trust policy (upstream-pinned single mechanism; refs #464) by @​eltorrero in #491
• docs(skills): add session-hygiene skill and mandatory gate by @​castrojo in #424
• docs(skills): capture merge-queue, consumer-CI, and Renovate learnings by @​castrojo in #402
• docs(skills): bring remaining skill files into canonical skill spec conformance by @​mrbobbytables in #471
• ci: test the Renovate auto-merge PR-lookup matcher end-to-end by @​kylerankin in #488
• fix(factory): exclude cancelled/action_required from success rate by @​kylerankin in #495
• [sec-check] fix: declare top-level permissions: {} in consumer-validation and prune-merged-branches by @​mrbobbytables in #466
• test(bats): add unit tests for 4 bootc-build composite actions by @​castrojo in #451
• ci(unit-tests): expand bootc-build path filter to cover all actions by @​castrojo in #452
• fix(validate-pr): handle spaces in system_files shellcheck paths by @​castrojo in #454
• fix(chunka): avoid E2BIG by passing inspect JSON via file instead of argv by @​mendezr in #473
• fix(promote): skip queued promotion branch rebuilds by @​castrojo in #463
• fix(scan-image): fail-closed when trivy-results.json is missing by @​HuntedRaven7 in #427
• fix(workflows): add top-level permissions: {} to consumer-validation and prune-merged-branches by @​mrbobbytables in #456
• fix: add top-level permissions: {} to consumer-validation and prune-merged-branches workflows by @​mrbobbytables in #457
• fix(ci): pass RESOLVE_OK via env in release-gate verify step by @​mrbobbytables in #458
• fix(tests): isolate podman-missing bats test from preinstalled runner podman by @​mrbobbytables in #459
• fix(promote): make reviewer requests optional by @​Siddhj2206 in #455
• fix(bootc-build): use kernel overlayfs in reusable-build by @​KiKaraage in #443
• fix(renovate-automerge): await nonterminal check states instead of blocking by @​castrojo in #448
• docs(ujust): specify console QR codes for reports by @​kylerankin in #44
• docs: update scope to ujust report framework and remove stale references by @​castrojo in #41
• chore: remove lifecycle workflow and obsolete files by @​castrojo in #40
• fix(ci): read MERGERAPTOR_APP_ID from secrets in sync-templates by @​castrojo in #39
• ci: allow ubuntu-26.04 runner labels in actionlint config by @​castrojo in #38
• fix(report): require diagnostic Gists by @​castrojo in #36
• Rename 2026-12-30-brazilian-bluefin.md to 2026-09-30-brazilian-bluefi… by @​castrojo in #1442
• Publish blog post on Ubuntu's community building by @​castrojo in #1440
• feat(blog): draft post for How We Built Ubuntu's 65M+ Community by @​castrojo in #1439
• Add brazilian-bluefins blog post by @​delphicmelody in #1428
• perf(ci): build locales in parallel shards so build time stays flat by @​castrojo in #1420
• docs(i18n): translate installation, mission, values, command-line into Czech by @​Danathar in #1423
• fix(i18n): correct ExtensionManager Flathub link casing across 5 locales by @​castrojo in #1424
• i18n(de): translate index.md and UI strings for German by @​castrojo in #1421
• i18n(sv): translate index.md and UI strings for Swedish by @​kylerankin in #1409
• feat(i18n): translate docs: Indonesian (id) by @​kylerankin in #1413
• feat(i18n): translate core docs and UI strings into Vietnamese (vi) by @​kylerankin in #1405
• docs: translate index.md and UI strings to Spanish by @​kylerankin in #1414
• i18n(uk): translate index.md and UI strings for Ukrainian by @​kylerankin in #1416
• i18n(ko): translate index.md and UI strings for Korean by @​dtg01100 in #1418
• docs(analytics): describe the daily projectbluefin-countme ping by @​castrojo in #1355
• fix: give Utah a real tag series in the update-churn pipeline by @​dtg01100 in #1419
• docs: add Czech (cs) i18n translations by @​castrojo in #1408
• i18n(fr): translate index.md and UI strings for French by @​castrojo in #1415
• perf(ci): cut pages.yml build time — parallel fetch-data, verify job, leaner caches by @​castrojo in #1411
• i18n(hi): translate index.md and UI strings for Hindi by @​dtg01100 in #1410
• i18n(tr): translate index.md and UI strings for Turkish by @​dtg01100 in #1407
• i18n(ar): translate index.md and UI strings for Arabic by @​dtg01100 in #1406
• docs: translate docs into Chinese (Traditional) (zh-Hant) by @​castrojo in #1401
• docs: add Chinese (Simplified) zh-Hans docs translation by @​kylerankin in #1404
• i18n(pl): translate index.md and UI strings for Polish by @​kylerankin in #1402
• Add download section to Utah documentation by @​castrojo in #1403
• fix(i18n): close review gaps in translated builds by @​castrojo in #1400
• docs(skills): add countme reporting diagnosis procedure by @​castrojo in #1354
• feat(i18n): open 20 locales for PR-based docs translation by @​castrojo in #1379
• Change header style in blog post by @​castrojo in #1378
• Update blog on Bluefin development insights by @​castrojo in #1377
• Add section on project visualization with gource by @​castrojo in #1376
• Revise Bluefin development visualization blog post by @​castrojo in #1375
• feat: Bluefin development visualized blog post by @​castrojo in #1374
• fix(docs): point the Dakota page's Bluefin Classic link at /classic by @​castrojo in #1369
• fix(driver-versions): order tabs Bluefin, Server, Classic, Utah by @​castrojo in #1368
• Update Dakota alpha information and add Bluefin Classic note by @​castrojo in #1367
• Revise Dakota description and alpha status by @​castrojo in #1366
• Revise Bluefin Classic documentation by @​castrojo in #1365
• fix(images): name the catalog cards Bluefin and Bluefin Classic by @​castrojo in #1364
• feat(docs): order the Images catalog Bluefin, Classic, Utah by @​castrojo in #1363
• feat(docs): order Images sidebar and add the Classic legacy ISOs by @​castrojo in #1362
• feat(docs): remove Bluefin LTS and GDX from the site by @​castrojo in #1361
• Rename Dakota to Bluefin and update content by @​castrojo in #1360
• Revise Utah documentation for alpha status by @​castrojo in #1359
• Update warning message for legacy ISOs by @​castrojo in #1358
• Modify sidebar items and remove Donations category by @​castrojo in #1357
• Update Docusaurus config for Bluefin documentation by @​castrojo in #1356
• feat(analytics): read the Bluefin card from daily pings too by @​castrojo in #1350
• feat(analytics): add a Bluefin Utah chart between Bluefin and Bluefin Classic by @​castrojo in #1349
• docs(ai): replace ramalama with llmman by @​castrojo in #1348
• refactor(countme): cut /v1 to a daily ping counted per image by @​castrojo in #1347
• feat(countme): allowlist Bluefin image names and split daily counts per image by @​castrojo in #1346
• fix(countme): create eos tables in the Worker, drop the migration step by @​castrojo in #1345
• feat(countme): receive eos-phone-home pings in the canonical Worker by @​castrojo in #1344
• feat(countme): chart Bluefin stable and testing check-ins by @​castrojo in #1343
• feat(portal): source PortalNews from local blog index and align unavailable state by @​repires in #1340
• fix(countme): preserve raw pings outside published Dakota series by @​castrojo in #1342
• fix(countme): acknowledge Dakota reports after storage by @​castrojo in #1339
• feat(leaderboards): render Recent Milestones as horizontal scroller below Community Builders by @​castrojo in #1337
• feat(images): rework catalog for Bluefin Classic at ublue-os, Dakota, and Utah by @​castrojo in #1335
• feat(leaderboards): add Recent Milestones leaderboard as a ledger of teamwork by @​castrojo in #1336
• feat(leaderboards): add GNOME seasons and modern standings by @​castrojo in #1333
• refactor: route remaining hand-rolled GitHub auth sites through shared clients by @​sramkrishna in #1327
• fix(registry): support REGISTRY_CACHE_HOURS=0 to keep live task data fresh on deploy by @​castrojo in #1332
• fix(ci): allow manual force refresh on update-hive-cache workflow by @​castrojo in #1331
• fix(leaderboard): restore freshness and accurate contributor ranking by @​castrojo in #1330
• fix: typo in contributors name by @​ahmedadan in #1329
• refactor: route sbom GHCR token reads through shared githubToken by @​mendezr in #1315
• fix(branding): make the monthly social preview card actually rotate by @​Danathar in #1313
• docs: record the green-skip signature for a missing BLUEFIN_DISCUSSIONS_TOKEN by @​Danathar in #1299
• Fix link text for latest Dakota daily snapshot by @​castrojo in #1325
• Embed YouTube video and update GNOME release note by @​castrojo in #1326
• fix(blog): use plain anchor for full resolution link in ImageCarousel by @​castrojo in #1323
• Revise bug reporting link and add lore content by @​castrojo in #1322
• fix(blog): use group role and aria-current for ImageCarousel thumbnail strip by @​castrojo in #1321
• feat(blog): add ImageCarousel component and gallery to Dakota Alpha 6 post by @​castrojo in #1320
• docs(blog): Dakota Alpha 6 release announcement and downloads by @​castrojo in #1319
• docs(analytics): switch countme opt-out instructions to systemctl disable timer by @​castrojo in #1308
• fix(countme): scope first-party telemetry tracking exclusively to dakota by @​castrojo in #1307
• fix/countme dakota exclusive by @​castrojo in #1306
• fix(countme): label dakota first-party charts as Bluefin by @​castrojo in #1305
• fix(analytics): focus first-party active systems chart solely on dakota by @​castrojo in #1304
• fix(countme): map root chart aliases to dakota by @​castrojo in #1303
• docs(skills): document Bluefin Classic rebadge in cloudflare-workers by @​castrojo in #1302
• fix(countme): rebadge upstream ublue-os/bluefin chart as Bluefin Classic by @​castrojo in #1301
• [architect] fix: propagate typecheck and lint exit codes in pages.yml validation step by @​castrojo in #1297
• [ci] skip open-discussion job when BLUEFIN_DISCUSSIONS_TOKEN is unset by @​castrojo in #1296
• refactor: converge CJS GitHub fetchers onto the shared request-queue client (#1232) by @​castrojo in #1295
• fix(blog): restore scrollable viewport constraint to left sidebar by @​castrojo in #1284
• ci: run the unit-test gate on every PR and run the knowledge-mcp suite by @​Danathar in #1290
• Revise warning about Dakotaraptor and legacy ISOs by @​castrojo in #1280
• Add warning for unsupported images in downloads by @​castrojo in #1278
• ci: add unit test gate for scripts by @​castrojo in #1226
• Factory: Optimize layout by combining data sections into 2-column rows on desktop by @​mrbobbytables in #1228
• fix(cards): parse HTML release-feed tables before generating Bluefin cards by @​mrbobbytables in #1213
• fix(sbom): add Bluefin LTS NVIDIA stream and retire dx/gdx package queries by @​mrbobbytables in #1212
• [architect] Converge ESM GitHub fetch sites onto lib/gh.js (#1232) by @​kylerankin in #1236
• fix(countme): count every published image variant under its family by @​castrojo in #1250
• test: add update artwork seams by @​TB516 in #1238
• fix(analytics): name the legacy panel for the image it counts by @​castrojo in #1251
• fix(repos): repair moved GitHub slugs and preserve partial repository-stat cache by @​kylerankin in #1256
• test: cover safeNum and loadHistory in fetch-hive-history.js by @​kylerankin in #1255
• [architect] converge hive-live + factory-stats fetchers onto shared lib/gh.js by @​kylerankin in #1257
• test: cover scripts/lib coverage-gap modules (#905) by @​kylerankin in #1254
• Add link to wolves.projectbluefin.io and follow-up note by @​castrojo in #1252
• fix(analytics): make the weekly active systems labels readable by @​castrojo in #1249
• fix(countme): ink the upstream chart title by @​castrojo in #1248
• feat(countme): serve the upstream chart in the Bluefin palette by @​castrojo in #1247
• Revise analytics documentation for Project Bluefin by @​castrojo in #1246
• feat(analytics): fold game mode into its image and show the upstream series by @​castrojo in #1245
• fix(analytics): serve weekly active systems from the first-party aggregate by @​castrojo in #1244
• fix(analytics): remove manufactured copy from the weekly active systems panel by @​castrojo in #1243
• fix(analytics): stop publishing internal service posture in a panel reason by @​castrojo in #1242
• fix(analytics): count our own images, and drop the last bar charts by @​castrojo in #1241
• feat(analytics): put the charts on the Bluefin palette and the real image matrix by @​castrojo in #1240
• feat(analytics): rebuild the charts around the full image matrix by @​castrojo in #1239
• feat(portal): add brand iconography, Karl backlog callout, and quotes to Users and Developers scenes by @​castrojo in #1211
• [quality] test: unit coverage for scripts/lib/sbom/api.js (GHCR tags, oras download, cosign verification) by @​Danathar in #1210
• test(scripts): silence unused-arg lint warning in build-metrics test by @​castrojo in #1225
• fix: consolidate CI supply-chain pins, light-mode repairs, and scripts/lib test coverage by @​castrojo in #1223
• test(portal): provide fixture data in PortalContributors static render test by @​castrojo in #1209
• fix(gnome-extensions): render missing and unavailable extension data states by @​castrojo in #1177
• fix(cards): preserve prevVersion on header chips by @​castrojo in #1174
• fix(driver-versions): generate Bluefin LTS release links with stable tags by @​castrojo in #1208
• feat(portal): implement PortalPageLoading overlay and character asset preloader by @​castrojo in #1207
• fix(portal): resolve nested <main> landmark, focus suppression, and WCAG AA contrast by @​castrojo in #1206
• feat(portal): implement PortalNews component consuming blog feed by @​castrojo in #1205
• feat(portal): implement PortalFlock section with DNF Count Me growth chart by @​castrojo in #1204
• feat(portal): harmonize design tokens, Inter font stack, and unified 956px/512px breakpoints by @​castrojo in #1203
• feat(portal): add "Try Out" secondary hero CTA and seasonal raptor character rotation by @​castrojo in #1202
• fix(analytics): align Countme family sparkline domains with rendered images by @​castrojo in #1201
• fix(portal): update navbar test links to match production navbar by @​castrojo in #1200
• fix(analytics): include Dakota and Utah in edition and workstation chart series by @​Danathar in #1194
• fix(analytics): retain Countme zeros and preserve missing values as gaps by @​Danathar in #1191
• fix(portal): reconcile TopNavbar navigation links and Docusaurus layout header by @​Danathar in #1169
• feat(portal): restore complete mission statements, Edith Wharton quote, and punchline by @​mrbobbytables in #1155
• fix(feed-items): supply NVIDIA versions at the data shape the release feed consumes by @​mrbobbytables in #1178
• fix(profiles): remove nonexistent chandeleer1698 GitHub username by @​mrbobbytables in #1151
• fix(pin-state): replace removed Bluefin LTS HWE workflow paths by @​Danathar in #1185
• fix(factory): calculate merged-this-week from merged pull requests by @​Danathar in #1190
• fix(factory): replace the Hive snapshot CTA hostname with a valid TLS endpoint by @​Danathar in #1189
• fix(factory): use a public queue-data fallback for anonymous visitors by @​Danathar in #1188
• fix(factory): render an unavailable change-failure rate instead of 0.0 percent by @​Danathar in #1187
• fix(sbom): migrate Bluefin LTS stream specs to its package and stable tags by @​Danathar in #1186
• fix(contributors): prevent visitor-side GitHub requests when contributor data is unavailable by @​mrbobbytables in #1197
• fix(countme): recognize Dakota and Utah without misclassifying Bluefin variants by @​mrbobbytables in #1198
• fix(blog): replace Printful CDN hotlinks blocked on five-years-of-bluefin by @​Danathar in #1196
• fix(catalog): generate Bluefin LTS rebases against the bluefin-lts package by @​Danathar in #1195
• fix(images): hide unpublished Utah testing image commands and attestations by @​Danathar in #1193
• fix(blog): remove expired Discourse CDN images from ublue-2024 wrap-up by @​Danathar in #1199
• fix(sbom): support version-qualified live tags in recent-release discovery by @​Danathar in #1163
• feat(portal): resolve 7 package version rows for Dakota product card by @​Danathar in #1164
• fix(ci): make generate-social-cards exit 0 when converters are missing by @​castrojo in #1182
• feat(analytics): modernize analytics and churn charts, promote page to top level by @​castrojo in #1181
• feat(branding): add rotating monthly night wallpaper social preview card by @​castrojo in #1179
• feat(branding): implement new social preview cards for documentation by @​castrojo in #1068
• fix(cards): parse HTML release-feed tables before generating Bluefin cards by @​castrojo in #1126
• fix(blog): replace Printful CDN hotlinks blocked on five-years-of-bluefin by @​castrojo in #1125
• fix(contributors): prevent visitor-side GitHub requests when contributor data is unavailable by @​castrojo in #1124
• fix(feed-items): supply NVIDIA versions at the data shape the release feed consumes by @​castrojo in #1123
• fix(gnome-extensions): render missing and unavailable extension data states by @​castrojo in #1122
• fix(pin-state): replace removed Bluefin LTS HWE workflow paths by @​castrojo in #1121
• fix(factory): render an unavailable change-failure rate instead of 0.0 percent by @​castrojo in #1120
• fix(factory): use a public queue-data fallback for anonymous visitors by @​castrojo in #1119
• fix(factory): replace the Hive snapshot CTA hostname with a valid TLS endpoint by @​castrojo in #1118
• fix(factory): calculate merged-this-week from merged pull requests by @​castrojo in #1117
• fix(analytics): calculate and format hero deltas for the selected range by @​castrojo in #1116
• fix(blog): remove expired Discourse CDN images from ublue-2024 wrap-up by @​castrojo in #1114
• fix(images): hide unpublished Utah testing image commands and attestations by @​castrojo in #1113
• fix(analytics): include Dakota and Utah in edition and workstation chart series by @​castrojo in #1111
• fix(analytics): retain Countme zeros and preserve missing values as gaps by @​castrojo in #1110
• fix(analytics): align Countme family sparkline domains with rendered images by @​castrojo in #1109
• fix(repos): repair moved GitHub slugs and preserve partial repository-stat cache by @​castrojo in #1107
• fix(sbom): migrate Bluefin LTS stream specs to its package and stable tags by @​castrojo in #1106
• fix(countme): recognize Dakota and Utah without misclassifying Bluefin variants by @​castrojo in #1105
• fix(driver-versions): generate Bluefin LTS release links with stable tags by @​castrojo in #1104
• fix(catalog): generate Bluefin LTS rebases against the bluefin-lts package by @​castrojo in #1102
• fix(profiles): remove nonexistent chandeleer1698 GitHub username by @​castrojo in #1101
• feat(portal): implement PortalNavigation floating dock and section scroll spy by @​mrbobbytables in #1153
• feat(portal): implement PortalContributors component and contributor harvester workflow by @​mrbobbytables in #1156
• fix(portal): update deprecated ublue-os links and synchronize Discord invite code by @​Danathar in #1165
• fix(portal): align Utah ecosystem card link destination to devconf.us by @​mrbobbytables in #1159
• feat(portal): generate bootc switch terminal command and copy button in PortalImageChooser by @​mrbobbytables in #1152
• test: add coverage reporting for data-fetching script tests by @​mrbobbytables in #1061
• fix(sbom): support version-qualified live tags in recent-release discovery by @​mrbobbytables in #1128
• feat(portal): add interactive image picker by @​castrojo in #1131
• feat(portal): complete static landing sections by @​castrojo in #1130
• feat(portal): add parallax portal prototype by @​castrojo in #1127
• docs: add Copilot workflow instructions by @​castrojo in #1108
• fix: link leaderboard contributor dossiers by @​castrojo in #1103
• fix: restore Hive leaderboard data and styling by @​castrojo in #1076
• feat: add standalone Hive leaderboards by @​castrojo in #1071
• feat(analytics): add update churn rate pipeline, analytics charts, and trigger workflow by @​castrojo in #1070
• feat: add Hive leaderboards landing by @​castrojo in #1069
• feat(nav): rename Factory to Hive in navbar linking to hive.projectbluefin.io by @​castrojo in #1058
• docs: announce Bluefin Server by @​castrojo in #1066
• fix(images): point bluefin-lts to projectbluefin/bluefin-lts package and update catalog by @​castrojo in #1067
• feat(analytics): unify Bluefin family countme charts and multi-image catalog by @​castrojo in #1065
• feat(analytics): add legacy bluefins and ecosystem countme analytics charts by @​castrojo in #1063
• feat(reports): migrate monthly reports to blog with infograms and Hive Leaderboard by @​castrojo in #1059
• fix: restrict countme worker entrypoint exports to default handler by @​castrojo in #1060
• docs: announce mcp.projectbluefin.io and update hive links by @​castrojo in #1057
• feat(mcp): serve the org knowledge base at mcp.projectbluefin.io by @​castrojo in #1055
• feat: refine image navigation, fix driver versions catalog, and track stable streams by @​castrojo in #1050
• feat(branding): use new Bluefin wordmark in docs and drop ublue 'u' by @​castrojo in #1043
• Add link to upstream doc about IME setup by @​sebjag in #1038
• fix(e2e): deliver the kickstart through an initramfs overlay by @​Danathar in #74
• fix(ci): restore ISO rename output and soft-fail arm64 legs by @​hanthor in #70
• fix(just): resolve sudo via PATH in sudoif and pass arguments without word-splitting by @​castrojo in #394
• fix(justfile): make the final artifact move idempotent in _build-bib by @​mendezr in #412
• ci(workflow): correct sync-stable-to-main header comment by @​kylerankin in #413
• ci(workflow): retry just download in unit-tests by @​kylerankin in #414
• fix(build): write an unverified update ref instead of a signed one by @​Danathar in #406
• fix(ci): skip Renovate when the token is not set by @​Siddhj2206 in #395
• ci(promote): stop citing the deleted scheduled approver by @​Danathar in #404
• fix(ci): restore merge_group trigger to pr-validation and unit-tests by @​castrojo in #418
• refactor: full rewrite of the template by @​castrojo in #393
• refactor: full rewrite of the template by @​Siddhj2206 in #383
• docs: document E2E gap as intentional release risk (#281) by @​mrbobbytables in #328
• ci: auto-approve action_required checks on trusted promotion PRs by @​mrbobbytables in #335
• fix(ci): validate Brewfiles statically instead of evaluating them as Ruby by @​Siddhj2206 in #320
• fix(just): use a per-invocation temp file for the registry tag list by @​Siddhj2206 in #314
• ci: run BATS unit tests on PRs touching build, tests, or Justfile by @​Siddhj2206 in #317
• fix(ci): stop inheriting all repo secrets in label-enforcement by @​Siddhj2206 in #318
• fix(just): build IMAGE_NAME from target_image so renames upgrade correctly by @​Siddhj2206 in #313
• fix(ci): derive ghcr-cleanup target from the repository name by @​Siddhj2206 in #319
• fix(ujust): stop install-jetbrains-toolbox when the checksum fails by @​Siddhj2206 in #315
• fix(just): repair clean recipe so it finishes and removes all artifacts by @​Siddhj2206 in #312
• fix(packages): stamp the provenance report from SOURCE_DATE_EPOCH, not the wall clock by @​dtg01100 in #343
• ci: add a tested factory-pin rev tool for #336 by @​dtg01100 in #337
• fix(packages): pin the baseurl of every allowlisted repository by @​dtg01100 in #334
• test(services): enforce the unit exit-tolerance convention by @​dtg01100 in #341
• fix(hooks): stamp 20-home-labels.sh after the body runs by @​dtg01100 in #327
• fix(e2e): accept substituted sentinel reads and re-read before reshooting by @​hanthor in #381
• fix(build): re-declare the factory pin ARG so the label bakes its value by @​hanthor in #374
• fix(build): key the package transaction on the factory pin, fail loud on skew by @​hanthor in #373
• chore(deps): update packages pin to GNOME 51.0 finals build by @​hanthor in #359
• test: label parity-ref tests as #152 pinned-ref work by @​kylerankin in #356
• docs: correct stale package-image copy statement in package-contract by @​kylerankin in #333
• fix(packages): reject proxy and sslverify=0 in allowlisted repositories by @​mendezr in #351
• fix(ci): let the kernel cache verify accept dispatch-run signatures by @​mendezr in #348
• feat(packages): add alsa-utils, restoring kernel mixer state across reboots by @​castrojo in #297
• fix(ci): sign the kernel cache digest the registry actually stored by @​kylerankin in #317
• chore(ci): bump actions pin for GNOME 51 gate fixes by @​hanthor in #315
• chore(ci): point release reusable at actions with preset-proof gate sshd by @​hanthor in #310
• feat(kernel): build v4l2loopback for every flavor's kernel by @​Danathar in #298
• fix(packages): add default-fonts-core-emoji to the parity contract by @​buggtb in #296
• fix(image): strip extension build toolchain closure from shipping image by @​hanthor in #295
• fix(iso): retry flaky Flathub pulls 5x so a timeout window can't fail E2E by @​hanthor in #285
• feat(packages): printing and cameras, from the 2026-09-26 factory image by @​hanthor in #282
• fix(selinux): keep Hummingbird's useradd HOME; only generate the rules from /home by @​hanthor in #283
• fix(selinux): label /var/home so GNOME Initial Setup can create the account by @​hanthor in #281
• fix(iso): build the tacklebox live ISO with release compression by @​hanthor in #280
• feat(iso): installs boot to GNOME Initial Setup, as Bluefin and Dakota do by @​hanthor in #279
• feat(packages): pin the 2026-09-26 factory image; Wi-Fi, Files, phones, printing, Initial Setup by @​hanthor in #265
• fix(packages): install samba, samba-winbind and samba-winbind-clients by @​buggtb in #268
• fix(ci): scope download-integrity clearance to each fetch by @​mendezr in #233
• feat: build live ISOs for unpublished variants via tacklebox by @​hanthor in #252
• fix(iso): installed systems get their Flatpaks (the dock was empty) by @​hanthor in #272
• fix(iso): retry flatpak remote-add, which fetches over the network by @​hanthor in #270
• chore(iso): pin bootc-installer v2026.09.25-51f8cfe6 (offline installs of Utah work) by @​hanthor in #269
• feat(baselines): measure Utah against the published Bluefin and Dakota images by @​hanthor in #264
• fix(parity): install the Bluefin base packages Utah can resolve today by @​hanthor in #266
• fix(e2e): count flatpak runtimes when checking the offline default set by @​hanthor in #267
• fix(iso): let the installer create the first account by @​hanthor in #260
• fix(iso): keep the listed GTK3 theme runtimes in the live ISO by @​hanthor in #256
• fix(desktop): enable per-user services — installed Utah had no audio by @​hanthor in #255
• fix(boot): installed systems boot again — keep the base's shim-paired GRUB, guard the EFI chain (#253) by @​hanthor in #254
• fix(iso): separate installed-desktop and installed-fastfetch captures by @​repires in #243
• ci: opt the testing stream into rechunking and build SBOMs by @​mendezr in #226
• fix(packages): install device firmware, which the bootable base ships none of by @​sramkrishna in #236
• fix: mask serial-getty@ttyS0 so desktops stop spamming the journal by @​sramkrishna in #235
• fix: repoint install-flatpaks.sh at tuna-os/bootc-installer by @​Danathar in #219
• ci: retain gated production ISO artifacts by @​Danathar in #198
• fix(iso): tighten live ISO size budget by @​Danathar in #206
• chore(deps): update actions/upload-pages-artifact action to v5 by @​hanthor in #234
• ci: gate the live boot on the UTAH_LIVE_READY serial marker by @​mendezr in #229
• fix(iso): force software GL rendering for the E2E test's terminal by @​Danathar in #224
• test(installer): assert offline payload and default Flatpaks survive encrypted install by @​Danathar in #215
• test: cover btrfs live-kernel contract by @​Danathar in #207
• ci: document Utah testing-stream rechunk gate by @​Danathar in #205
• docs: close README/skill package-count drift against the manifests by @​Danathar in #225
• fix(flavors): single-source flavor to image name mapping in flavors.py by @​mrbobbytables in #144
• fix(desktop): enable input-remapper.service for desktop input devices by @​mrbobbytables in #148
• ci(parity): pin check-parity upstream fetch to committed revision by @​mrbobbytables in #152
• ci: stop a testing build cancelling the one before it, which is losing the ISO evidence the release gate needs by @​hanthor in #185
• ci(release): stop a missed stable release from looking exactly like a normal merge by @​hanthor in #195
• fix: fall back to kernel module tree and refuse empty kernel releases in verify-rpm-contract by @​mrbobbytables in #204
• fix: enable PipeWire user units so GNOME screencast can start by @​KiKaraage in #177
• fix(installer): harden live-media boot paths and define Secure Boot strategy by @​mrbobbytables in #143
• Retry Flathub pulls, so one timed-out object cannot fail a flavor's ISO by @​hanthor in #162
• fix(nvidia): bump the driver for kernel 7.2, and make the base bump actually build by @​hanthor in #182
• fix(packages): correct evolution-ews-core parity debt after EDS closure builds by @​kylerankin in #191
• fix: disable nvidia-container repo on non-NVIDIA flavors by @​kylerankin in #192
• ci: drop timestamp from generated skill catalog to avoid merge conflicts by @​mrbobbytables in #193
• site: publish a status and project information page on GitHub Pages by @​hanthor in #164
• fix(image): stop shipping the 4 GB package repository in every image, and check Hummingbird signatures by @​hanthor in #133
• fix: enable the btrfs kernel module in the OGC gaming-flavor kernel by @​kylerankin in #158
• ci: stop fork pull requests failing on a GHCR permission they cannot have by @​hanthor in #184
• fix(packages): single-source install repository identity in packages/*.repo by @​mrbobbytables in #146
• fix(desktop): mask bootc-fetch-apply-updates across cross-vendor etc merge by @​mrbobbytables in #153
• fix: stop shipping the 4 GB package repository in every image (#128) by @​kylerankin in #156
• test(ci): add unit tests for check-download-integrity and check_workflow_outputs by @​mrbobbytables in #147
• fix: enable bluetooth.service for desktop adapters by @​kylerankin in #125
• feat(packages): install what Bluefin inherits from Fedora's base and Hummingbird already has by @​hanthor in #129
• fix(iso): get the LUKS end-to-end test green on all four flavors by @​hanthor in #94
• test: unit coverage for scripts/flavors.py flavor-matrix queries — new tests/test_flavors.py, just test recipe by @​mendezr in #118
• fix(uupd): pin and verify uupd.service/uupd.timer against committed digests by @​kylerankin in #124
• fix(e2e): capture the fastfetch shot at 1080p, with its logo by @​hanthor in #112
• fix(packages): ship glibc-all-langpacks so a chosen locale exists by @​hanthor in #116
• fix: keep GSConnect loading on GNOME 51 (clipboard final-type) by @​mrbobbytables in #89
• fix: resolve OGC kernels when assembling live ISOs by @​hanthor in #87
• fix(iso): repair CI handoff, payload digests, and live kernel support by @​hanthor in #86
• ci: automate LUKS ISO validation and screenshot evidence by @​hanthor in #84
• Build the Utah ISO, install it to an encrypted disk, and prove the desktop starts by @​hanthor in #41
• fix(build): resolve the pinned package contract before composing Utah by @​hanthor in #82
• docs: Utah's current status by @​HuntedRaven7 in #31
• feat: compose Utah from a local package repository by @​hanthor in #37
• supply-chain: pin and verify executable image and installer downloads by @​hanthor in #32
• ci: stop main waiting on the kernel cache; cut layer overhead per flavor by @​hanthor in #33
• feat: build zram-generator packages by @​mendezr in #294
• feat: build zram-generator packages (carries #294) by @​castrojo in #301
• fix(ci): report nothing for a cancelled run instead of every package as failed (carries #271) by @​castrojo in #300
• feat(feeds): poll 68 more upstreams via explicit lock feeds by @​hanthor in #296
• fix(libadwaita): drop obsolete sassc backport, merged upstream in 1.10.0 by @​hanthor in #299
• fix(gsettings): drop GConf .convert files removed upstream in GNOME 51.0 by @​hanthor in #298
• chore(gnome): bump the GNOME 51 stack off prerelease to 51.0 finals by @​hanthor in #295
• feat(supply-chain): lock factory buildroots and require recipe provenance by @​Danathar in #186
• fix: retry the hermetic lane's online steps and package v4l-utils' udevd drop-in by @​clubanderson in #288
• fix(sources): reset release on upstream version bumps by @​arteeh in #281
• fix(ci): drop canary inject_failure from build matrix (#285) by @​mrbobbytables in #286
• ci(validate): give check_workflow_quoting and runtime_contract a PR-wide trigger by @​buggtb in #282
• feat(libass): update to 0.17.5 by @​hanthor in #266
• fix: prevent lock screen password controls from overlapping by @​arteeh in #290
• feat(ci): let a dispatch build and publish only named packages by @​hanthor in #279
• fix(printing): import pdfio for libcupsfilters, and rebuild libgphoto2 by @​hanthor in #278
• fix(enchant2): build without the Nuspell backend by @​hanthor in #276
• feat(publish): resolve the blocking transaction in Utah's pinned base by @​hanthor in #277
• fix(build): resolve the hermetic root with best=0, like the container lane by @​hanthor in #275
• feat(publish): publish each wave's successes as that wave finishes by @​hanthor in #274
• fix(publish): a bootstrap build never replaces the real package by @​hanthor in #273
• fix(publish): resolve Utah's install set in Utah's own base image by @​hanthor in #272
• feat(publish): resolve what Utah actually installs, and track each gap by @​hanthor in #270
• fix(publish): import libexif and ghostscript for libgphoto2 and libppd by @​hanthor in #269
• fix(plan): call a published build stale only when its soname moved by @​hanthor in #268
• feat(xdg-terminal-exec): update to 0.14.3 by @​hanthor in #265
• feat(build): make the hermetic mock lane the default by @​hanthor in #264
• fix(publish): let a re-run publish over its own earlier attempt by @​hanthor in #262
• fix(ci): keep a canary dispatched on main away from the tracking issue by @​hanthor in #261
• feat(build): hermetic mock lane -- lock the build root, build offline from the lock by @​hanthor in #260
• feat(build): rebuild what changed and what BuildRequires it, on every merge by @​hanthor in #259
• ci(build): retry a failed %check once before failing the package by @​hanthor in #256
• feat(publish): publish each good build, keep a failed package's previous one by @​hanthor in #258
• ci(canary): prove pipeline changes on the real workflow in minutes by @​hanthor in #257
• fix(buildroot): keep the pin in config/ and move it to the first mirror image by @​hanthor in #255
• ci(buildroot): factory-owned build-root mirror, and a cache key that survives a publish by @​hanthor in #252
• fix(publish): lead the repository image with a repodata-only layer by @​hanthor in #254
• feat: import Utah runtime dependencies with no factory recipe by @​hanthor in #246
• fix(publish): log in for the provenance attestation and keep it from failing a publish by @​hanthor in #253
• fix(python-pydantic-core): BuildRequire python3-packaging for %prep by @​hanthor in #250
• fix(publish): close the ffmpeg and libosinfo runtime closure by @​hanthor in #249
• fix: restore python-pydantic and build pydantic-core from vendored crates by @​hanthor in #248
• fix(librist): backport upstream's nettle 4.0 support by @​hanthor in #245
• chore: remove python-pydantic and python-pydantic-core from the factory by @​hanthor in #244
• fix(libppd): include <cstdint> before cups/transcode.h by @​hanthor in #243
• fix(librist): correct the 0.2.11-1 changelog year so rpm accepts the spec by @​hanthor in #242
• fix(srt): build with the OpenSSL EVP backend instead of gnutls+nettle3.10 by @​hanthor in #241
• fix(ci): upgrade libxml2 to Hummingbird's split release before builddep by @​hanthor in #240
• fix(grub2): efi_vendor=fedora so GRUB sits beside Utah's shim (Utah install e2e red since 09-21) by @​hanthor in #238
• test: gate architecture inventory counts by @​Danathar in #194
• fix(factory): source rebuild matrix package set from source_locks by @​repires in #232
• fix(import): skip factory-sourced packages in Rawhide resolver by @​mrbobbytables in #185
• refactor(ci): align Justfile check with CI workflow gate catalog by @​mrbobbytables in #196
• fix(ci): verify cosign signature before seeding from the factory image by @​Danathar in #215
• fix(ci): gate sccache setup to mozjs140 to prevent token exposure by @​repires in #227
• fix(validate): refuse a recipe that silences its own %check by @​Danathar in #197
• fix(publish): close the consumer-transaction dep closure by @​hanthor in #229
• fix(dist_bump): tolerate macro-based Release fields (carries #100) by @​hanthor in #138
• fix(verify): pin srt, libcue, game-music-emu, cjson to Fedora lookaside primaries by @​hanthor in #231
• feat(printing): add cups-filters, cups-browsed, libcupsfilters, and libppd recipes by @​mrbobbytables in #214
• ci(audit): pin pyyaml and declare it for the unit tests job by @​mendezr in #221
• feat(packages): import google-noto-color-emoji-fonts and stix-fonts recipes by @​mrbobbytables in #199
• docs: define ORAS source lookaside policy by @​mrbobbytables in #189
• fix(linux-atm): pin kernel-headers to 6.19.6 for atmsvc.h by @​hanthor in #218
• fix: exclude libicu-77 from every build root by default, with per-package opt-in by @​hanthor in #217
• feat: ppp/libpcap/linux-atm/libgda closure parity (utah-packages#149) by @​kylerankin in #203
• feat: add libfprint + fprintd recipes for fingerprint login parity (#145) by @​kylerankin in #204
• feat: import microcode_ctl for CPU errata parity by @​kylerankin in #205
• fix(scan): skip malformed repoquery lines instead of crashing the scan by @​kylerankin in #206
• feat: add alsa-utils recipe for mixer-state restore (Dakota parity) by @​kylerankin in #202
• fix(rebuild): build nautilus-python after nautilus by @​Danathar in #213
• fix(gaps): drop runtime-contract [unavailable] packages from the parity report by @​mendezr in #207
• fix(renovate): require human review for github-actions updates by @​mrbobbytables in #193
• fix(factory): defer base packages to Hummingbird by @​hanthor in #191
• docs(ci): preserve the package cache contract by @​hanthor in #184
• feat(ci): restore and publish per-package RPM cache by @​hanthor in #183
• feat(ci): cache key for per-package build reuse, and the rule for when to use it by @​hanthor in #178
• fix: enforce recipe-set agreement across the three package sources by @​kylerankin in #164
• fix(dist_bump): tolerate macro-based Release fields by @​kylerankin in #100
• ci: pin zstandard version in rebuild-rpms prepare job (#105) by @​mendezr in #109
• ci: pin zstandard in the prepare job (carries #109) by @​hanthor in #137
• fix(quality): add missing provenance for gnome-desktop3 and malcontent-bootstrap by @​mrbobbytables in #98
• fix(ci): guard build toolchain containers against mutable tags by @​kylerankin in #110
• fix(workflows): bind rawhide dispatch inputs via env, not run interpolation by @​kylerankin in #114
• Build the whole Utah contract: 343 recipes, Firefox as a Flatpak, four stage failures fixed by @​hanthor in #70
• test: add unit coverage for tools/scan_rawhide_state.py by @​kylerankin in #99
• fix(ci): pin build toolchain containers by digest by @​kylerankin in #88
• ci: repin Packit SRPM image to live digest by @​Danathar in #85
• fix(buildroot): exclude legacy ruby default-gems from Hummingbird repo by @​mrbobbytables in #83
• fix(tailscale): disable incompatible jsonv2 experiment by @​Danathar in #86
• ci: publish factory repositories atomically after closure validation by @​kylerankin in #89
• fix(gcc): drop gcc from the rebuild set, let Hummingbird supply it by @​kylerankin in #90
• fix(batch): consolidate verified fixes for tools, ci checksum, rawhide import, and contract (#71, #72, #56, #57) by @​castrojo in #92
• refactor(tools): wrap check_workflow_quoting and validate in testable functions by @​castrojo in #73
• ci: make the compiler cache outlive the build container by @​hanthor in #33
• fix: keep GSConnect loading on GNOME 48+ (clipboard final-type) by @​hanthor in #53
• feat: compose a local Utah package repository by @​hanthor in #34
• feat(packit): wire packit srpm into a real pilot job by @​castrojo in #41
• fix(packit-sdk): use upstream quay.io/packit/packit instead of rebuilding by @​castrojo in #40
• fix(packit-sdk): publish as ghcr.io/projectbluefin/packit-sdk by @​castrojo in #38
• fix(packit-sdk): share DOCKER_CONFIG auth between podman and cosign by @​castrojo in #37
• feat(packit-sdk): add pinned Packit+Mock build image by @​castrojo in #36
• ci: build WebKitGTK as two shards on two runners by @​hanthor in #32

Dakota (GNOME OS Prototype)​

• feat(bluefin): ship ChairLift's privileged helper, policy and schemas by @​castrojo in #1680
• fix(next): apply Dakota fdsdk patches and mesa-extra on next by @​ahmedadan in #1700
• fix(next): apply Dakota fdsdk patches and mesa-extra on next by @​ahmedadan in #1696
• feat(image): enable hardware video codecs for host apps by @​ahmedadan in #1687
• fix(ghostscript): avoid CMYK crash in ROM profiles by @​ahmedadan in #1682
• feat(image): ship nspawn for OCI-backed nspawn machines by @​ahmedadan in #1681
• fix(libvirt): restore PolicyKit-authorized access by @​ahmedadan in #1673
• fix(image): make /usr/local a real link to /var/usrlocal by @​ahmedadan in #1661
• fix(ci): require diagnostic report intake by @​castrojo in #1528
• feat(bluefin): add user-configured IBus Rime with Lua support by @​KOTONEX in #1662
• revert(countme): restore pre-session common pin (#1649, #1656) by @​castrojo in #1657
• fix(countme): pin shared weekly reporter by @​castrojo in #1656
• fix(image): vendor libvirt and make shadowed packages actually ship by @​ahmedadan in #1651
• fix(countme): ship shared Dakota reporter by @​castrojo in #1649
• feat(countme): remove local countme client and units by @​castrojo in #1622
• ci(release): require explicit stable promotion by @​ahmedadan in #1637
• fix(gnome-shell): use portable unzip flags for extension installs by @​ahmedadan in #1628
• fix(virtualization): prevent default NAT firewall failures by @​ahmedadan in #1625
• fix(ujust): drop flatpak -y so polkit can prompt by @​ahmedadan in #1630
• fix(bluefin): stop GDM fingerprint retry loop on unenrolled readers by @​ahmedadan in #1627
• ci: gate merges on the PR build when a PR is labeled build by @​ahmedadan in #1618
• fix(kernel): carry hid-asus build fix for OGC 7.2.6-ogc1 by @​ahmedadan in #1617
• fix(kernel): carry hid-asus build fix for OGC 7.2.6-ogc1 on next by @​ahmedadan in #1616
• chore(kernel): bump OGC gaming kernel to 7.2.6-ogc1 on testing by @​ahmedadan in #1613
• chore(kernel): bump next to 7.3-rc3 and OGC 7.2.6-ogc1 by @​ahmedadan in #1612
• ci: label-gated PR builds and SBOM job repair by @​ahmedadan in #1610
• fix(ci): smoke-test the image Publish built, not the default-branch tip by @​Danathar in #1605
• fix(ci): pin cosign to a digest-pinned installer instead of releases/latest by @​Danathar in #1606
• chore(just): drop the monitor-pipeline recipe whose script no longer exists by @​Danathar in #1607
• feat(ghostty): disable resize overlay by default to prevent Wayland loop by @​castrojo in #1571
• fix(kernel): restore desktop capabilities across streams by @​ahmedadan in #1598
• ci(next): empty NEXT_MERGED and track GBM master by @​ahmedadan in #1590
• chore(next): track gnome-build-meta master by @​ahmedadan in #1589
• feat: NVIDIA 615.71.09 and freedesktop-sdk 26.08.1 on testing by @​ahmedadan in #1588
• feat: GNOME 51 and freedesktop-sdk 26.08 on testing by @​ahmedadan in #1579
• ci(arm): pause automation until boot validation works by @​ahmedadan in #1566
• fix(chunkah): fetch remote companion data before reading by @​ahmedadan in #1564
• feat(chunkah): generate ownership during image builds by @​ahmedadan in #1563
• feat(extensions): update syncthing-toggle to bluefin-bling v2 by @​castrojo in #1557
• fix(ci): isolate ChairLift tests from runner defaults by @​ahmedadan in #1550
• fix(brew): migrate ChairLift off the Frostyard tap by @​ahmedadan in #1542
• fix(desktop): avoid broken and intrusive defaults by @​ahmedadan in #1538
• fix(next): avoid adjacent dependency sync conflict by @​ahmedadan in #1526
• fix(skills): make factory frontmatter parseable by @​ahmedadan in #1525
• fix(extensions): preserve metadata when extracting ZIPs by @​ahmedadan in #1518
• docs(factory): audit documentation and standardize skills by @​castrojo in #1516
• feat(launcher): package vicinae and bind launcher toggle to Super+Space by @​castrojo in #1515
• feat(ghostty): configure dual-theme to track GNOME Dark/Light style by @​castrojo in #1514
• feat(extensions): swap bluetooth-battery-meter for budslink-companion and preinstall flatpak by @​castrojo in #1512
• feat(extensions): package and enable quick-settings-audio-panel by @​castrojo in #1511
• feat(extensions): package curated gnome shell extensions by @​castrojo in #1510
• fix(devmode): adapt developer setup to Dakota by @​ahmedadan in #1509
• fix(fastfetch): inherit Bluefin presentation from common by @​ahmedadan in #1507
• chore(build): remove unreachable architecture configuration by @​ahmedadan in #1499
• fix(scripts): gen-filemap refuses partial caches, tests pin kernel match by @​ahmedadan in #1484
• feat(kernel): Linux 7.2 bump with Fedora-audited hardware enablement by @​ahmedadan in #1473
• ci: revalidate retargeted PRs and document CI-run Justfile recipes by @​ahmedadan in #1485
• fix(ci): open monthly filemap PRs against testing, not main by @​ahmedadan in #1467
• fix(ci): sync-next owns files/linux-ogc with the rest of the kernel set by @​ahmedadan in #1475
• chore(packages): bump uwelcome to v0.3.5 for the portal timeout fix by @​ahmedadan in #1462

Contributors​

Sources​

• github-activity: available (2026-09-01 to 2026-09-30): source
• github-lanes: available (2026-09-01 to 2026-09-30): source
• github-releases: available (2026-09-01 to 2026-09-30): source
• github-releases: available (2026-09-01 to 2026-09-30): source
• github-releases: available (2026-09-01 to 2026-09-30): source
• countme: unavailable — Countme active-system measurement is incomplete. (2026-09-01 to 2026-09-30): source
• homebrew: available (2026-09-01 to 2026-09-30): source
• flathub: available (2026-09-01 to 2026-09-30): source

Alright, here it is, Bluefin Server, this one actually boots. This is the base of the Bluefin Factory, the thing you'll build your homelab on. And in turn, your desktops or whatever you want. Kubernetes for the home.

An FSDK-based, image-based Linux server OS.**

To celebrate this milestone, enjoy the latest video, with some fresh lore!

Bluefin Server targets the same use-case space as Flatcar Container Linux, Kairos, Fedora CoreOS, and Talos, but is built from scratch with BuildStream 2 from freedesktop-sdk (FSDK 26.08) components and uutils coreutils.

It is designed to be installed and then managed entirely through the Kubestellar GUI. I'll be releasing point releases quickly over the next few days. After the install it will give you a web address, then you go to it on your computer. Then that's it, your perfect home server.

Except the dashboards are empty. The more people we have making these the better, including a ZFS one! This variant will have ZFS support so now's the time to jump onboard!

It is DDI first: the OS payload is a compressed XFS DDI filesystem image that is deployed by an offline, systemd-native installer.

Release status: Alpha​

Bluefin Server is currently in Alpha:

• Milestone status: Phase A (reproducible build path, uutils, k0s sysext, graph validation) is complete. Phase B (automated boot verification on lab cluster) is in progress.
• systemd-sysupdate should work, we're about to find out! configurations.
• Readiness roadmap: Track completed criteria and remaining gates toward 1.0 in docs/MVP_1_0_READINESS.md.

How this works​

• A/B root rollback — an MVP 1.0 gate: 50-root.transfer names root-a and root-b; the installer currently creates only root-a.
• DDI-first delivery — the installer embeds the OS payload as a data partition; no network is required at install time. This is basically Linux systemd style.
• Minimal, distroless OS image — no shell in the running rootfs by default IS what we are shooting for. We'll probably fail at this lol.
• systemd-native installer — systemd-sysinstall provides the interactive terminal UI and systemd-repart handles partitioning and block-copy DDI placement. Finally distro installers can all go die!
• Optional k0s as a systemd-sysext so the base image stays distroless. We started with k3s but I want to see how this one goes, stripped down for the home.

SSH ON: SSH is enabled for cluster boot tests and remote debugging. It is scheduled for removal once diagnostics move to serial logs or a guest agent. See docs/skills/factory-integration.md.

Quick start​

Bare metal sorely needed! However this runs on any Linux, feel free to fire up a VM and start designing that dashboard! Once we get home assistant and all the goodies it'll be amazing! Thanks for checking it out!

You need only podman and just. BuildStream runs inside the FSDK bst2 container, so BuildStream is not installed locally.

just validate              # resolve the element graph
just show-me-the-future    # end-to-end QEMU installer smoke test

See AGENTS.md for the full build command matrix, hard rules, and agent skill routing.

Contributing​

See CONTRIBUTING.md for the contributor checklist, Conventional Commit rules, and docs/skills/index.md for task-specific guidance.

Participation

Human and automated contributions with current contributors.

Show the numbers

Human and automation activity data for August 2026 UTC (2026-08-01 to 2026-08-31)

Label	Human	Automation
Report period	258	283

🏆 Hive Leaderboard

Hive Leaderboard: Community Heroes

Celebrating our top community builders across the Project Bluefin factory

RankContributorImpactProjectsMilestone

#01@castrojo109 PRscommonbluefinbluefin-lts+6Top Hero#02@ahmedadan35 PRscommonbluefindakotaHigh Velocity#03@hanthor24 PRscommonbluefinbluefin-lts+6High Velocity#04@Danathar20 PRsbluefindakotatestsuiteHigh Velocity#05@mrbobbytables13 PRsbluefindakotatestsuiteHigh Velocity#06@bketelsen11 PRsbluefinbluefin-ltstestsuite+1High Velocity#07@Siddhj22065 PRsactionsfinpilotHigh Velocity#08@joshyorko4 PRscommonbluefintestsuite+1Cross-Fleet#09@HuntedRaven73 PRscommonbluefin-ltsutahCross-Fleet#10@rapenne-s2 PRsdakota#11@Giklab1 PRcommon#12@kylerankin1 PRtestsuite#13@onlydole1 PRtestsuite#14@theMimolet1 PRcommon#15@tunix1 PRfinpilot

Release details remain on the canonical /changelogs surface.

Completed work​

• feat(motd): add uwelcome + update umotd by @​theMimolet in #815
• fix(brew): trust vendored taps so preinstalled casks actually install by @​ahmedadan in #1047
• fix(report): read the boot-time booted-image snapshot when bootc status fails by @​ahmedadan in #1030
• fix(report): read booted tag from bootc, not baked image-info by @​ahmedadan in #1020
• fix(brew): keep preinstall off login critical path by @​ahmedadan in #1006
• fix(brew-preinstall): journal-safe output capture, no /dev/stderr by @​ahmedadan in #998
• fix(brew): correct linuxbrew prefix spelling and preinstall tap ordering by @​ahmedadan in #997
• feat(brew): ship managed ChairLift integration by @​castrojo in #985
• fix(brew): handle cask lifecycle in brew-preinstall by @​HuntedRaven7 in #981
• feat(ujust): honor ACTION in toggle-updates for non-interactive use by @​hanthor in #966
• test: add BATS regression coverage for theming hook by @​kubestellar-hive in #926
• fix(fastfetch): exit cleanly when binary is unavailable by @​castrojo in #931
• test(docs): add check-skill-index regression tests by @​kubestellar-hive in #924
• fix(ujust): preserve report copy when optional files are absent by @​castrojo in #917
• fix(report): preserve external queue preferences by @​joshyorko in #936
• fix(ujust): bootstrap fzf for --choose by @​castrojo in #902
• fix(ci): stop validate failing on stale generated_at date by @​castrojo in #937
• test(docs): add skill validator coverage by @​kubestellar-hive in #911
• feat(brew): preinstall ChairLift with Bluefin maintainer config by @​castrojo in #853
• ci: make the advisory E2E signal mean something by @​castrojo in #914
• ci: stop running E2E on docs-only pushes by @​castrojo in #913
• fix(gnome): enable smoke-tested extensions by @​castrojo in #912
• docs: collapse issue forms to one and delete phantom label taxonomy by @​castrojo in #909
• fix(flatpak): correct Thunderbird Flatpak ID by @​Giklab in #906
• fix(build): checkpoint the rpmdb out of WAL mode at every stage commit by @​Danathar in #1153
• docs(ci): record Firefox failure after testsuite fix by @​Danathar in #1143
• docs(ci): record Testing Images build failing since 2026-08-12 (#995) by @​Danathar in #1136
• test(brew): assert the brew-preinstall payload, not just its trampoline by @​Danathar in #1135
• fix(framework): drop user-setup hook that installs a nonexistent brew formula by @​Danathar in #1132
• fix(lab-check): find the existing check run on busy commits by @​Danathar in #1100
• docs(ci): document :testing promotion blocker set for #989 by @​mrbobbytables in #1091
• docs(ci): document merge-queue GH006 race and stuck-promotion diagnosis by @​mrbobbytables in #1106
• docs(ci): document the :testing stream-tag leak triage path for #989 by @​mrbobbytables in #1096
• docs(ci): document that :testing can freeze for weeks, masking triage (#929) by @​mrbobbytables in #1095
• fix(framework): remove stale hid_sensor_hub karg from AMD Framework laptops by @​mrbobbytables in #1103
• ci: raise BATS coverage threshold from 30% to 45% by @​mrbobbytables in #1104
• docs(ci): explain the nested testsuite workflow refs by @​castrojo in #1077
• ci(lab-check): point the Checks-permission fix at the right screen by @​Danathar in #1079
• test(build): regression-guard missing IMPORTANT_PACKAGES entries (#965) by @​mrbobbytables in #1090
• docs(workflow): note Closes #NNN only fires on the default branch by @​mrbobbytables in #1092
• docs(ci): document stable-promotion blocker set for #929 by @​mrbobbytables in #1089
• ci(bonedigger): drop the remaining no-op triggers and dead permission by @​Danathar in #1085
• ci: gate stable promotion to Tuesday window by @​Danathar in #1076
• fix(ci): preserve builds after Renovate merges by @​joshyorko in #1111
• test(brew): assert the brew-preinstall delivery path ships in the image by @​Danathar in #1081
• docs(security): correct CVE-2026-33186 root cause — podman is a second carrier by @​Danathar in #1082
• test(framework): assert fw-charge-control.conf ships in the built image by @​Danathar in #1080
• ci: guard the testsuite workflow contract by @​Danathar in #1044
• docs(security): document the cosign signature-format requirement by @​hanthor in #1071
• ci: actually remove the mirrored validate status shim by @​castrojo in #1074
• ci: replace mirrored validate status with real check on merge queue by @​castrojo in #1072
• fix(packages): add fzf to base package manifest (#965) by @​hanthor in #1057
• docs(release): clarify e2e gates for stable promotion by @​Danathar in #1049
• ci(bonedigger): drop the no-op schedule trigger by @​hanthor in #1061
• test(framework): lock fw-charge-control.conf battery health fix by @​hanthor in #1060
• test(ci): lock ctx-build stage 1 context to its required inputs by @​hanthor in #1059
• ci(lab-check): surface actionable error when MergeRaptor token mint is denied by @​hanthor in #1058
• [quality] ci(unit-tests): enforce 30% BATS line coverage threshold by @​kubestellar-hive in #1037
• fix(ci): run base-branch guard on main-targeted PRs by @​castrojo in #1041
• [sec-check] fix: pr-validation.yml add permissions block (contents: read) by @​kubestellar-hive in #1038
• docs(security): document CVE-2026-33186 in buildah (no F44 fix available) by @​ahmedadan in #1018
• docs(ci): record MergeRaptor Checks write requirement for lab check by @​castrojo in #1010
• fix(ci): run gitlink check against github.sha by @​castrojo in #1034
• ci: restore managed testsuite v1 ref and stop Renovate re-pinning it by @​castrojo in #1012
• ci(bonedigger): drop the no-op pull_request trigger by @​castrojo in #1011
• docs(skills): record e2e gate triage and tag verification by @​castrojo in #1013
• fix(ci): propagate BATS failures by @​bketelsen in #1015
• fix(factory): extract merge-group status mirror by @​bketelsen in #1021
• fix(build): fully isolate Stage 2 and ISO contexts by @​bketelsen in #1020
• fix(renovate): consolidate repository config by @​bketelsen in #1017
• fix(framework): enable native battery charge control by @​bketelsen in #1019
• ci: document the :testing tag gate on the reusable-build caller by @​castrojo in #992
• docs(skills): note release input trust and worktree merge cleanup by @​castrojo in #998
• feat(ci): add BATS coverage reporting artifacts by @​castrojo in #911
• docs(skills): record CI gating and worktree failure modes by @​castrojo in #994
• docs(skills): adopt the factory skill front-matter contract by @​castrojo in #991
• chore: enforce isolated worktrees for feature work by @​castrojo in #980
• chore(release): remove legacy manifest changelog by @​bketelsen in #973
• fix(build): invalidate package layer for build file changes by @​castrojo in #964
• docs: add agent fast path and every-loop repair contract by @​castrojo in #984
• docs(workflow): replace placeholder bonedigger TODO with real tracking issue by @​castrojo in #982
• docs: sync agentic procedures with projectbluefin/common by @​castrojo in #979
• fix(image): include bootupd for bootc installs by @​castrojo in #962
• ci: verify common extension defaults by @​castrojo in #955
• ci: verify E2E health fixes by @​castrojo in #952
• ci: verify testsuite v1 E2E fixes by @​castrojo in #950
• ci: rerun E2E with testsuite v1 fixes by @​castrojo in #949
• chore: sync issue templates from common by @​castrojo in #946
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #944
• fix(ci): use managed testsuite v1 by @​castrojo in #941
• fix(ci): force GET method for gh api in nvidia manifest assembly by @​HuntedRaven7 in #530
• fix: install dnf5 so bluefin-lts-countme.service can run by @​hanthor in #502
• chore(release): remove legacy manifest changelog by @​bketelsen in #497
• fix(ci): unblock PR lint and the promotion release gate by @​hanthor in #501
• fix(ci): assemble signed multi-arch manifest for bluefin-lts-nvidia:testing by @​castrojo in #472
• ci(lab): publish PR results through MergeRaptor by @​castrojo in #456
• chore: sync issue templates from common by @​castrojo in #487
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #486
• test(dx): add unit tests for dx_distrobox_can_be_created (#501) by @​mrbobbytables in #755
• fix(installer): gate the LUKS assertion on the target, not a dead env var by @​Danathar in #754
• feat(dx): gate distrobox create/install/export on a cached image at runtime by @​Danathar in #753
• [sec-check] fix: declare top-level permissions: {} in build-kde-runner.yml build-runner.yml by @​kubestellar-hive in #750
• fix(smoke): preserve Firefox AT-SPI env for Flatpak exports by @​Danathar in #741
• feat(e2e): compose test software as a container layer instead of runtime install by @​hanthor in #744
• [sec-check] fix: pr-validate.yml add permissions block (contents: read) by @​kubestellar-hive in #738
• [sec-check] fix: unit-tests.yml add permissions block (contents: read) by @​kubestellar-hive in #739
• docs(skills): document design gate and verification requirements for #487 by @​hanthor in #747
• test(smoke): scope composefs capability check to Fedora-shipped caps by @​hanthor in #749
• docs(skills): link projectbluefin/lab#621 to distrobox image-cache gap #501 by @​hanthor in #748
• test(common): cover ujust toggle-updates via its non-interactive ACTION contract by @​hanthor in #746
• fix(shared): refuse dbus autolaunch and snapshot session state on readiness failure by @​castrojo in #737
• [quality] add new coverage for untested areas (epic #705) by @​kubestellar-hive in #733
• test(common): make Dakota ujust chooser and report coverage non-vacuous by @​castrojo in #735
• feat(common): add non-interactive devmode coverage via bctl by @​onlydole in #724
• fix(shared): survive GDM restart in GNOME shell readiness gate by @​castrojo in #727
• fix(e2e): enforce the @hardware_blocked tag in CI and at runtime by @​castrojo in #726
• docs: reconcile factory-model governance contradictions and correct the ghost-lab merge gate by @​castrojo in #732
• test(scripts): assert KDE installer behaviour instead of its source text by @​castrojo in #730
• fix(ci): generate suite-map coverage snapshot instead of hand-editing by @​castrojo in #728
• fix(smoke): restore Bluefin release gate reliability by @​castrojo in #731
• feat(installer): add post-boot assertions for UEFI, Flatpak exclusion, and LUKS cmdline by @​kylerankin in #697
• docs(behave): trim SKILL.md under the 500-line cap by @​castrojo in #729
• fix(smoke): restore Bluefin release gate reliability by @​joshyorko in #691
• test(scripts): add unit tests for validate_docs.py by @​kubestellar-hive in #675
• test(software): add CLI-driven Flatpak per-app permission coverage by @​castrojo in #710
• test(common): add Dakota ujust report and chooser regression coverage by @​castrojo in #699
• test: cover orca, input-methods and xwayland smoke step logic by @​castrojo in #709
• docs: onboard testsuite to the common factory model and remove the PR cap by @​castrojo in #694
• test: cover GNOME shell readiness helper by @​kubestellar-hive in #672
• feat(developer): add pending bctl.feature scenarios ahead of CI unmask by @​mrbobbytables in #722
• docs: record OOBE first-boot investigation by @​bketelsen in #715
• fix(software): initialize shared SSH context with coverage by @​bketelsen in #721
• docs(skills): capture SSH context contract and unit-test stub pitfalls by @​castrojo in #723
• build(dashboard): migrate to @tailwindcss/vite, drop @astrojs/tailwind by @​castrojo in #716
• test(scripts): add installer contract coverage for KDE webdriver by @​kubestellar-hive in #676
• test(flatcar): implement Ignition and update-disable lifecycle scenarios by @​castrojo in #711
• docs: add update-cadence research informed by testsuite validation by @​hanthor in #713
• fix(smoke): enable Firefox AT-SPI accessibility and stop the filler false pass by @​castrojo in #692
• test(dx): add distrobox create/install/export scenarios behind @pending by @​castrojo in #720
• fix(software): set SSH context for shared ssh_steps in the suite by @​castrojo in #718
• fix(e2e): enforce non-runnable tag filters by @​bketelsen in #717
• docs(behave): record ujust toggle-updates non-interactive blocker (#499) by @​castrojo in #714
• docs: add issue templates for the agent intake path by @​castrojo in #700
• docs: codify .worktrees/ isolation policy and agent worktree hygiene by @​castrojo in #695
• fix(ci): count job-summary scenarios explicitly instead of by subtraction by @​castrojo in #698
• chore: ignore extracted image roots and local e2e diagnostics by @​castrojo in #708
• fix(ci): count @pending scenarios as stubs in coverage badges by @​castrojo in #701
• test: resolve overdue quarantine debt and reclassify infra-blocked scenarios by @​castrojo in #693
• fix(e2e): preserve smoke health capacity by @​castrojo in #684
• fix(e2e): preserve image extension defaults by @​castrojo in #683
• fix(smoke): preserve monitor layout when scaling by @​castrojo in #682
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #681
• fix(ci): render e2e heredoc delimiter correctly by @​castrojo in #680
• fix(ci): restore e2e workflow heredoc indentation by @​castrojo in #678
• [scanner] fix: publish PXE boot artifacts by @​kubestellar-hive in #23
• docs: add SECURITY.md vulnerability disclosure policy by @​castrojo in #17
• fix(promote): derive squash branch name from inputs everywhere by @​Siddhj2206 in #423
• fix(sign-and-publish): pin cosign to legacy .sig format for podman/bootc by @​hanthor in #420
• [sec-check] fix: pin renovate version, declare top-level permissions in reusable-sync-branches by @​kubestellar-hive in #417
• [sec-check] fix: actionlint.yml declare least-privilege permissions by @​kubestellar-hive in #415
• [quality] add regression coverage for _section_footer in render_pr_body by @​kubestellar-hive in #412
• fix(check-token-health): support GitHub App installation tokens by @​kubestellar-hive in #418
• fix(ci): use the self-repository prefix in renovate-automerge by @​castrojo in #406
• fix(build): stop leaking the stream tag when publish_stream_tag=false by @​castrojo in #405
• fix(renovate): stop managing first-party projectbluefin/actions refs by @​castrojo in #401
• ci(actions): make mergeraptor auto-merge actually fire on main by @​castrojo in #400
• ci(actions): migrate internal composition to self-repository syntax by @​castrojo in #392
• fix(ci): use secrets.MERGERAPTOR_APP_ID and client-id in factory workflows by @​castrojo in #354
• [quality] add CLI regression tests for consumer-contract script by @​kubestellar-hive in #378
• fix(actions): resolve bundled cosign installer from self repository by @​castrojo in #376
• [quality] add BATS coverage for sign-and-publish SBOM path generation by @​kubestellar-hive in #371
• test(scripts): cover promotion body scripts by @​kubestellar-hive in #369
• [quality] add entrypoint regression coverage by @​kubestellar-hive in #366
• [quality] add regression tests for render_card placeholder fallback by @​kubestellar-hive in #367
• fix(tests): prioritize scripts/ over .github/actions copies in sys.path by @​kubestellar-hive in #370
• [quality] expand sign-and-publish BATS coverage for cache and attach failure paths by @​kubestellar-hive in #372
• fix(report): apply external queue preferences by @​joshyorko in #34
• docs: add Future of Bluefin video post by @​castrojo in #1037
• ci: add just check pre-commit gate by @​castrojo in #1035
• docs: add /dakota variant page by @​castrojo in #1036
• chore: remove stale content and dead dashboard code by @​castrojo in #1034
• refactor: remove dead code and replace hand-rolled helpers with stdlib by @​castrojo in #1033
• docs(blog): add post on Bazzite killing the gamer kernel by @​castrojo in #1032
• docs: add "The Wolves Are Coming" blog post with Bluesky embed by @​castrojo in #1030
• fix(cards): source the Dakota release card from the SBOM cache by @​castrojo in #1029
• fix(factory): attribute Hive to KubeStellar, not an individual by @​castrojo in #1028
• fix(countme): count devices the way ublue-os/countme counts them by @​castrojo in #1027
• fix(factory): correct branding terminology, relabel countme, drop non-owned toolbox images by @​castrojo in #1026
• feat(factory): two-level navigation and first-party chart parity by @​castrojo in #1025
• docs(blog): publish Dakota Alpha 5 by @​castrojo in #1020
• docs(downloads): promote Dakota alpha5 by @​castrojo in #1019
• feat(release-cards): add deterministic release-context renderer and action by @​castrojo in #1018
• fix(containerfile): break dnf.conf hardlink before config-manager setopt by @​tunix in #258
• [scanner] docs: document Renovate alert permission by @​kubestellar-hive in #276
• docs: align signing, branch-model, and promotion docs with current behavior by @​Siddhj2206 in #273
• feat(ci): enable keyless image signing by default by @​Siddhj2206 in #271
• fix(ci): enable native overlay for faster layer commits by @​Siddhj2206 in #266
• fix(ci): grant packages:read to promotion reusable caller by @​Siddhj2206 in #259
• ci: add two-branch main/stable workflow with factory promotion reusable by @​castrojo in #240
• fix: prevent clean-stage.sh glob failure on empty /var/cache by @​castrojo in #243
• fix(ci): harden workflow security — pin renovate, add clean.yml permissions by @​castrojo in #239
• feat(factory): onboard Hive issue workflow by @​castrojo in #218
• fix(ci): simplify rechunking enablement by @​bketelsen in #220
• fix(build): stop copying default just recipes from common OCI by @​hanthor in #227
• Move to agentic workflows and skills by @​hanthor in #226
• fix(packages): install gum for default ujust recipes by @​castrojo in #221
• fix: changed up how the common repo is used by @​HuntedRaven7 in #6
• Add Utah GNOME desktop and live ISO bring-up by @​hanthor in #5
• Build Utah on Hummingbird with the GNOME 51 stack, all four flavors by @​hanthor in #1
• Add GNOME 51 GDM to the package factory by @​hanthor in #12
• Let cosign see the registry login the publish step already made by @​hanthor in #3
• Import the package factory: GNOME 51 for Hummingbird, published as an OCI image by @​hanthor in #1

Dakota (GNOME OS Prototype)​

• fix(ujust): preserve newlines in confirm/report/verify by @​rapenne-s in #1331
• fix(image): create plugdev and nintendo_switch groups for udev rules by @​ahmedadan in #1424
• fix(ci): sync-next merges small next tweaks instead of restoring files by @​ahmedadan in #1419
• fix(packages): ship fastfetch binary expected by common wrapper by @​ahmedadan in #1417
• [scanner] fix: include dmidecode for bios-info by @​kubestellar-hive in #1391
• fix(fastfetch): show real stream tag via boot-time booted-image sync by @​ahmedadan in #1393
• fix(image): unbreak fresh-ISO post-install (uwelcome, brew, devmode) by @​ahmedadan in #1388
• ci(build): queue runs FIFO with stale-run gate, detach source tracker by @​ahmedadan in #1384
• chore(kernel): align testing on Linux 7.1.8 by @​ahmedadan in #1379
• chore(kernel): move next kernels to stable 7.2 by @​ahmedadan in #1378
• perf(image): compose the host toolchain once by @​ahmedadan in #1377
• fix(chunkah): preserve export mtimes by @​ahmedadan in #1376
• refactor(agent): reduce eager context by @​ahmedadan in #1362
• ci(aarch64): stop queueing x86 builds behind ARM in the CAS group by @​ahmedadan in #1359
• fix(ci): tolerate owned paths absent from next during sync by @​ahmedadan in #1357
• fix(elements): complete the fdsdk 26.08 port across all variants by @​ahmedadan in #1356
• ci(next): build next images on every content push by @​ahmedadan in #1354
• fix(elements): stage sandbox shell explicitly for fdsdk 26.08 by @​ahmedadan in #1353
• ci(next): derive fdsdk pin and patches from tracked gnome-build-meta by @​ahmedadan in #1352
• ci(next): add patches/linux-ogc to the sync overlay by @​ahmedadan in #1346
• ci(next): replace merge sync from main with overlay sync-next workflow by @​ahmedadan in #1345
• fix(gaming): repin LuaJIT after upstream deleted the ROLLING tag by @​ahmedadan in #1344
• ci(release): disable broken GNOME 50 smoke gate on stable promotion by @​ahmedadan in #1342
• fix(brew): bump common for prefix fix, ship make, guard spelling by @​ahmedadan in #1341
• feat(bluefin): add brlaser CUPS driver by @​rapenne-s in #1329
• ci(e2e): correct installer-suite gating docs and add a dispatch recipe by @​Danathar in #1323
• docs(e2e-ci): spec fisherman installer post-boot assertions, correct status by @​mrbobbytables in #1330
• ci(release): schedule Dakota stable promotions Mon/Wed/Fri by @​Danathar in #1322
• test: add avatar-audit to catch #353-class dinosaur-avatar regressions by @​Danathar in #1308
• fix: restore Bluefin dinosaur avatars in GNOME user-account picker by @​mrbobbytables in #1302
• ci: run validate on PRs targeting main by @​castrojo in #1318
• [quality] add Python regression tests for workflow and filemap scripts by @​kubestellar-hive in #1276
• ci(e2e): expose installer suite on workflow_dispatch (fisherman post-boot assertions) by @​hanthor in #1316
• docs(skills): record /dev/stdin regression and why CI cannot catch it by @​castrojo in #1303
• fix(elements): stop using /dev/stdin for inline file writes by @​castrojo in #1298
• fix(audio): unfold pcsp install command; YAML folding emptied artifact by @​ahmedadan in #1297
• fix(audio): disable PC-speaker WirePlumber sink by @​castrojo in #1257
• fix(gaming): pin Steam .deb to versioned pool URL; CDN swaps content by @​ahmedadan in #1279
• fix(gaming): ship 32-bit GL/Vulkan drivers and re-enable Steam UI GPU by @​ahmedadan in #1278
• feat(nvidia): update to 610.57.04 and ship its missing data files by @​ahmedadan in #1277
• fix(bluefin): support ydotool on CMake 4 by @​ahmedadan in #1267
• feat(bluefin): add ydotool input automation by @​castrojo in #1258
• chore: sync issue templates from common by @​castrojo in #1264
• ci: retire skill-drift.yml (no-op stub) by @​castrojo in #1263
• fix(ci): delete .github/workflows/lab-check.yml by @​castrojo in #1260
• fix(zswap): disable zram via integration command, overlap lost by @​ahmedadan in #1262

Contributors​

Sources​

• github-activity: available (2026-08-01 to 2026-08-31): source
• github-lanes: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• github-releases: available (2026-08-01 to 2026-08-31): source
• countme: available (2026-08-01 to 2026-08-31): source
• homebrew: available (2026-08-01 to 2026-08-31): source
• flathub: unavailable — Flathub statistics could not be read. (2026-08-01 to 2026-08-31): source

Participation

Human and automated contributions with current contributors.

Show the numbers

Human and automation activity data for July 2026 UTC (2026-07-01 to 2026-07-31)

Label	Human	Automation
Report period	126	427

🏆 Hive Leaderboard

Hive Leaderboard: Community Heroes

Celebrating our top community builders across the Project Bluefin factory

RankContributorImpactProjectsMilestone

#01@castrojo104 PRscommonbluefinbluefin-lts+6Top Hero#02@ahmedadan12 PRsdakotaactionsHigh Velocity#03@Siddhj22062 PRsfinpilot#04@clubanderson1 PRbluefin-lts#05@daegalus1 PRdakota#06@elephantum1 PRcommon#07@hanthor1 PRdakota#08@KiKaraage1 PRcommon#09@theMimolet1 PRcommon#10@Xarianne1 PRdakota#11@znmeb1 PRdocumentation

Release details remain on the canonical /changelogs surface.

Completed work​

• feat(brew): re-enable ChairLift bootc staging via system-integration split by @​castrojo in #892
• feat: add brewfile for common fonts by @​theMimolet in #891
• fix(framework): remove obsolete hid_sensor_hub karg by @​castrojo in #896
• feat(ujust): streamline report submission by @​castrojo in #895
• docs(skills): fix skill-drift staleness, split lab-testing, build real skill catalog by @​castrojo in #890
• feat(ujust): confirm existing issue reports by @​castrojo in #842
• feat(bazaar): add Freelens to curated developer tools by @​elephantum in #804
• feat(brew): add rancher-cli & rancher-machine to k8s-tools by @​KiKaraage in #809
• fix(gnome): disable blur-my-shell popup blur by default by @​castrojo in #813
• fix(bluefin): set image and video MIME defaults to shipped GNOME apps by @​castrojo in #824
• fix(containerfile): use per-file raw fetches for game-devices-udev by @​castrojo in #825
• fix(ci): make merge queue lane build-only in build.yml by @​castrojo in #826
• chore(deps): update golang:alpine docker digest to 9097beb by @​castrojo in #829
• chore(deps): update actions/cache action to v6.1.0 by @​castrojo in #830
• chore(deps): update homebrew/actions digest to 841d750 by @​castrojo in #831
• ci: add docs-hygiene pre-commit checks by @​castrojo in #838
• fix(ujust): select LTS changelog repository by @​castrojo in #840
• test: cover OEM brew hook by @​castrojo in #841
• docs: document clanker-queue label and human-advisor repo model by @​castrojo in #880
• ci(execute-release): enable release e2e gate for stable promotion by @​castrojo in #837
• fix(hardware): mitigate Framework Core Ultra ucsi_acpi s2idle resume failures by @​castrojo in #910
• fix(sleep): disable psmouse wakeup on HP ZBook Ultra G1a + add missing 20-framework.sh hook by @​castrojo in #912
• refactor(build): rewrite kernel-akmods orchestration in Python by @​castrojo in #914
• fix(ci): mirror validate to merge-group queue head by @​castrojo in #760
• fix(release): use build SBOM artifact for stable notes by @​castrojo in #764
• feat(iso): embed stable Titanoboa contract by @​castrojo in #828
• fix(qa): include Wayland test dependencies by @​castrojo in #830
• docs(qa): clarify ponytail package contract by @​castrojo in #832
• docs: overhaul agent documentation by @​castrojo in #862
• test: cover GNOME extension build stages by @​castrojo in #864
• test: cover changelog generation by @​castrojo in #866
• test: cover image validation gate by @​castrojo in #868
• ci(lab): publish PR results through MergeRaptor by @​castrojo in #902
• fix(kernel): default LTS to HWE/CoreOS stable by @​castrojo in #405
• fix(ci): publish multi-architecture testing manifests by @​castrojo in #433
• [quality] add BATS unit tests for 20-packages.sh and 40-services.sh by @​clubanderson in #441
• fix(ci): assemble and sign multi-arch manifest list for testing stream by @​castrojo in #452
• fix(ci): unindent heredoc delimiters in e2e.yml by @​castrojo in #669
• feat(smoke): add comprehensive sudo-rs e2e test suite by @​castrojo in #632
• fix(common): repair immutable SSH Python quoting by @​castrojo in #617
• docs: document uupd suppression contract blocker by @​castrojo in #665
• fix(kde): make AT-SPI WebDriver transport reachable (D2) by @​castrojo in #651
• feat(smoke): add fractional scaling coverage by @​castrojo in #609
• docs(skills): record sparse-checkout and PR-trigger blind-spot traps by @​castrojo in #663
• docs(skills): make the merge-gate guidance evergreen by @​castrojo in #664
• fix(smoke): accept Showtime as OOTB video player in MIME allowlist by @​castrojo in #598
• feat(smoke): add GNOME Online Accounts panel scenarios by @​castrojo in #600
• feat(smoke): add XWayland on-demand coverage by @​castrojo in #599
• feat(common): add screenshot portal scenarios by @​castrojo in #601
• fix(common): repair 5 false-negative scenarios blocking the release gate by @​castrojo in #602
• feat(smoke): add input method and keyboard layout coverage by @​castrojo in #603
• feat(smoke): add Orca screen reader coverage by @​castrojo in #605
• fix(smoke): rework GNOME 50 overview and lock scenarios for headless by @​castrojo in #606
• feat(smoke): add printing stack coverage by @​castrojo in #607
• feat(common): add ScreenCast portal plumbing scenarios by @​castrojo in #608
• feat(ci): publish per-suite coverage badges to gh-pages by @​castrojo in #611
• docs: harden agent doc tree and fix stale internal references by @​castrojo in #613
• ci: add reusable ISO validation workflow by @​castrojo in #619
• fix(common): quote SSH embedded Python commands by @​castrojo in #633
• docs: remove artificial open PR cap by @​castrojo in #634
• docs: update projectbluefin lab references by @​castrojo in #635
• docs(skills): enforce read-only access to all KDE namespaces by @​castrojo in #639
• feat(kde): implement KDE session preconditions by @​castrojo in #641
• ci(kde): add KDE host-side runner image and skill by @​castrojo in #640
• feat(kde): add KDE D-Bus control plane helpers and tests by @​castrojo in #642
• feat(kde): add W3C WebDriver wrapper and retry policy for AT-SPI by @​castrojo in #643
• feat(kde): add kde_faillog failure artifact bundle by @​castrojo in #644
• ci(kde): wire KDE suites into reusable e2e workflow by @​castrojo in #645
• test(kde): add kde-smoke informational suite (13 scenarios) by @​castrojo in #647
• docs: document KDE Plasma coverage in README and CONTRIBUTING by @​castrojo in #648
• fix(kde): add ssh and git to the KDE runner image by @​castrojo in #652
• fix(kde): repair kde-smoke helper API and remove silent skip by @​castrojo in #653
• fix(kde): support Plasma Login Manager and correct precondition lifecycle by @​castrojo in #654
• docs(ci): mark the ghost-lab merge gate as unavailable and document the real gate by @​castrojo in #656
• refactor(kde): use the shared is_kde_image predicate in kde-smoke by @​castrojo in #657
• fix(dashboard): pin astro to v5 so publish-to-pages npm ci resolves by @​castrojo in #658
• docs(ci): re-point the ghost-lab gate note at lab#479 after #474 merged broken by @​castrojo in #660
• docs: correct post-merge counts and stale KDE/CI claims by @​castrojo in #661
• docs: finalize documentation overhaul and add doc-quality gates by @​castrojo in #10
• docs: full documentation audit for Bluefin Server by @​castrojo in #9
• fix(runner): accept naive overlay diff on Ubuntu kernels by @​ahmedadan in #360
• fix(runner): allow Podman updates with native overlay by @​ahmedadan in #351
• fix(runner): prevent stale nested overlay mounts by @​ahmedadan in #350
• fix(automerge): mint app token so queue checks dispatch by @​ahmedadan in #348
• fix(create-release): avoid runtime playwright install for release cards by @​castrojo in #315
• fix(release): call create-release via @v1 in reusable-release by @​castrojo in #316
• fix(release): fallback when SBOM artifact is missing by @​castrojo in #317
• feat(release): add testsuite e2e gate before stable promotion by @​castrojo in #319
• fix(test): drop stale tests for removed render_notes inventory helpers by @​castrojo in #320
• docs: authorize clanker-queue merges by @​castrojo in #342
• docs(ci): enforce existing discussion token contract by @​castrojo in #1015
• fix(ci): authenticate cross-repo discussion creation by @​castrojo in #1014
• fix(ci): authenticate discussion backfill workflow by @​castrojo in #1013
• fix: create Giscus discussions for published blog posts by @​castrojo in #1012
• docs: add Bluefin sausage factory draft by @​castrojo in #1011
• Update downloads-testing.mdx by @​znmeb in #1010
• docs: publish agentic development post by @​castrojo in #1008
• docs: add agentic development blog draft by @​castrojo in #1007
• docs: publish Five Years of Bluefin article by @​castrojo in #1004
• fix(countme): deploy worker with zone route by @​castrojo in #1001
• docs(blog): publish Bluefin LTS/GDX migration post by @​castrojo in #998
• test(iso): add artifact-backed stable installer E2E by @​castrojo in #68
• fix(brew): rsync @ublue-os/brew files and clarify Homebrew setup docs (#131) by @​Siddhj2206 in #138
• feat(build): add NVIDIA example and clarify script activation by @​Siddhj2206 in #164

Dakota (GNOME OS Prototype)​

• fix: restore Bluefin dinosaur avatars in GNOME user-account picker by @​castrojo in #1241
• docs(skills): document verification path for testsuite-owned E2E failures by @​castrojo in #1240
• fix(nvidia): preserve Mesa GBM on hybrid GPUs by @​ahmedadan in #1239
• fix(changelog): guard glow dependency and fix release-tag regex by @​Xarianne in #1231
• fix(ci): enqueue with app token so merge groups dispatch checks by @​ahmedadan in #1233
• fix(publish): pass push digests downstream instead of re-reading GHCR tags by @​ahmedadan in #1232
• chore(ci): delete .github/workflows/actionadon.yml by @​castrojo in #1229
• feat(zswap): transition from zram to optimized zswap configuration by @​castrojo in #1131
• fix(ci): align scorecard push trigger with default branch by @​castrojo in #1138
• fix(ci): align standard builds with upstream caches by @​ahmedadan in #1160
• fix(ci): wait for GHCR image visibility by @​castrojo in #1180
• fix(ci): publish dakota:aarch64 + add aarch64 boot gate (Asahi M0) by @​hanthor in #1190
• fix(bluefin): make optional common profile removal idempotent by @​castrojo in #1197
• fix(build): set GOROOT for remote Go builds by @​castrojo in #1198
• docs(skills): add merge-queue sequential queuing lesson by @​castrojo in #1203
• fix(bluefin): disable binary stripping on sudo-rs to preserve setuid bit by @​castrojo in #1209
• ci: publish lab results through MergeRaptor checks by @​castrojo in #1210
• feat(gaming): add gaming variant and adopt the OGC kernel for all variants by @​ahmedadan in #1212
• ci: make CAS warm-up pull non-fatal and fit a seeded cache by @​ahmedadan in #1215
• ci: fit the artifact push timeout to full image uploads by @​ahmedadan in #1216
• fix(kernel): enable ATH12K across variants by @​daegalus in #1226
• ci(build): route x86 variants through BuildBox remote execution by @​ahmedadan in #1227

Contributors​

Sources​

• github-activity: available (2026-07-01 to 2026-07-31): source
• github-lanes: available (2026-07-01 to 2026-07-31): source
• github-releases: available (2026-07-01 to 2026-07-31): source
• github-releases: available (2026-07-01 to 2026-07-31): source
• github-releases: available (2026-07-01 to 2026-07-31): source
• github-releases: available (2026-07-01 to 2026-07-31): source
• github-releases: available (2026-07-01 to 2026-07-31): source
• countme: available (2026-07-01 to 2026-07-31): source
• homebrew: available (2026-07-01 to 2026-07-31): source
• flathub: unavailable — Flathub statistics could not be read. (2026-07-01 to 2026-07-31): source

Desktop​

GNOME desktop environment, Aurora variant (KDE), and terminal enhancements

Planned Work​

• fix(motd): build umotd from source, move to shared layer, remove legacy ublue-motd by @​castrojo in #744
• fix(ux): toggle-user-motd exits 0 when user declines and fix fall-through by @​castrojo in #662
• fix(ujust,gnome): fix changelog repos + LTS support + BT auto-switch by @​castrojo in #543
• fix(gnome): open documentation link as local PDF with browser fallback by @​castrojo in #637
• test(bling): add bats coverage for bling.sh by @​castrojo in #629
• test(scripts): add bats coverage for ublue-motd and profile.d scripts by @​castrojo in #628
• chore: simplification audit — remove dead weight, harden edge cases by @​castrojo in #569
• feat(ghostty): add GNOME profile for new users by @​castrojo in #548
• feat(fonts): set Adwaita Mono as default monospace, move opendyslexic to Homebrew by @​castrojo in #547
• feat: replace logomenu with custom-command-menu extension by @​castrojo in #514
• fix: add help: URI handler to redirect to GNOME help website by @​castrojo in #509
• fix(bling): skip brew bundle when bluefin-cli disables bling by @​hanthor in #362
• feat: replace old MOTD with umotd by @​castrojo in #489
• fix(#266): drop monospace-font-name override — use GNOME default (Adwaita Mono) by @​hanthor in #348
• fix: remove Readymade installer from dock favorite-apps by @​hanthor in #353
• feat: switch to ublue-os/aurorafin-shared by @​renner0e in #395

Opportunistic Work​

• feat(brew): move CLI tools to brew-preinstall, remove starship image binary by @​castrojo in #554
• fix(ci): remove stale che/nerd-fonts COPR check by @​castrojo in #502
• feat(fonts): remove font RPMs and nerd-fonts COPR from OCI image by @​castrojo in #476
• fix: migrate custom-command-menu dconf to command1..N tuple format by @​castrojo in #348
• feat(build): add extension-builder stage to avoid build deps in final image by @​castrojo in #333
• security: verify starship binary checksum before extraction (CWE-494) by @​castrojo in #173
• fix(e2e): pin testsuite test_ref and restore shell defaults by @​castrojo in #337
• feat(fonts): remove jetbrains-mono-fonts-all from OCI image by @​castrojo in #144
• fix(packages): remove che:nerd-fonts COPR install by @​castrojo in #79
• fix: migrate custom-command-menu dconf from entryrow* to command1..N tuples by @​castrojo in #76
• fix(ci): use epel-10 chroot for jreilly1821/c10s-gnome-50 COPR URL by @​castrojo in #55
• fix(hive): hero font rendering + more sparklines by @​castrojo in #919

Dakota (GNOME OS Prototype)​

• feat(fonts): remove jetbrains-mono from image, manage via Homebrew by @​castrojo in #763
• fix(gnome-ponytail-daemon): use systemd.bst for systemd.pc pkgconfig by @​castrojo in #725
• feat: add gnome-ponytail-daemon to image by @​castrojo in #618

Development​

Development tools and IDE integrations

Planned Work​

• feat(dx): add tuna-os/Tavern flatpak to DX mode by @​castrojo in #792
• feat(bluefinctl): wire ujust recipes to bctl + move caffeinate to profile.d by @​castrojo in #730
• feat: rewrite toggle-devmode to be standalone DX mode by @​castrojo in #545
• fix(dx): move vscode extension installs to Brewfile by @​castrojo in #635

Opportunistic Work​

• Bump dockerd to 29.6.1 by @​jumpyvi in #460

Homebrew​

Package Updates​

36 automated updates this month via GitHub Actions. Homebrew tap version bumps ensure Bluefin users always have access to the latest stable releases.

Quick Summary​

Ecosystem​

Homebrew packages, AI/ML tools (Bluespeed), and Flatpak applications

Planned Work​

• fix(nvidia): update system flatpaks when rebooting into new nvidia image by @​castrojo in #769
• fix(flatpak): refresh appstream on every boot instead of firstboot only by @​castrojo in #767
• feat(oem): add Framework brew hook for framework_tool and wallpapers by @​castrojo in #753
• fix(brew): move bluefinctl.Brewfile to shared so all variants get bctl by @​castrojo in #750
• feat(bazaar): add Collabora + Spelling Bee + Whisp, refresh curation by @​KiKaraage in #731
• fix(brew): fix Homebrew 6.0 breakage across brew lifecycle by @​castrojo in #728
• chore(brew): remove bbrew, bluefinctl replaces it by @​castrojo in #729
• fix(brew): remove aichat + whisper-cpp, update agy + kimi-code by @​KiKaraage in #715
• fix(brew): Unblock system-cli & CNCF brewfiles validation by @​KiKaraage in #721
• feat(oem): move Framework/Ampere hardware hooks and icons to common by @​castrojo in #672
• fix(brew): trust ublue-os taps for Homebrew 6.0 compatibility by @​castrojo in #695
• feat(oem): add ASUS hardware auto-install hooks by @​castrojo in #692
• test(brew): add brew-preinstall bats tests, codecov, and sync test recipe by @​castrojo in #693
• feat(brew): add brew-preinstall service and system-cli.Brewfile by @​castrojo in #664
• feat(just): add ujust install-asus for ASUS laptop tools by @​castrojo in #503

Opportunistic Work​

• chore(oem): remove Framework brew hook now in common by @​castrojo in #670
• feat(brew): move CLI tools to brew-preinstall by @​castrojo in #205
• fix(cask): vsc-insiders versioning and vscodium linting by @​nklowns in #450
• fix(casks): revert arch-conditional sha256 in on_linux block, as breaks brew bump by @​nikodunk in #424

Dakota (GNOME OS Prototype)​

• feat(brew): move glow and fzf to brew-preinstall by @​castrojo in #834

System Services & Policies​

Systemd services and system-level policies

Planned Work​

• feat(uupd): smart AC-aware update scheduling by @​castrojo in #768
• fix: align rechunker-group-fix with bootc upstream recommendations by @​castrojo in #530
• feat: manage triager permissions via CODEOWNERS sentinel block by @​castrojo in #399
• add dynamic wallpaper timer by @​joshyorko in #349
• feat(profile): add caffeinate alias by @​hanthor in #360
• feat(ops): implement 7-day stale-claim reclaim automation by @​hanthor in #445
• fix(governance): activate TRIAGERS block in CODEOWNERS by @​hanthor in #437
• Fix LUKS UUID parsing on Dakota by @​dylanmtaylor in #385

Opportunistic Work​

• fix(countme): replace broken rpm-ostree-countme with dnf5-based service by @​castrojo in #326
• fix(services): enable rechunker-group-fix.service to prevent boot failure by @​castrojo in #133

Dakota (GNOME OS Prototype)​

• feat(bluefin): add Incus daemon, systemd integration, and ujust recipes (2/2) by @​bketelsen in #1126
• fix: wire firstboot-services.bst into deps.bst (#603) by @​hanthor in #608

Hardware​

Hardware support, drivers, NVIDIA GPU, and ARM64 architecture

Planned Work​

• fix(framework): migrate hid_sensor_hub karg to bootc toml by @​castrojo in #793
• test: add unit tests for check-oci-refs, bazaar-hook, hardware hooks, and nvidia-flatpak-sync by @​castrojo in #785
• feat(oem): add WirePlumber hardware profiles for Framework Desktop AMD Ryzen AI Max 300 by @​castrojo in #760

Opportunistic Work​

• fix(akmods): add --tmpdir /boot to dracut call to fix EXDEV on nvidia builds by @​castrojo in #586
• feat(nvidia): install nvidia-container-toolkit-base and configure CDI by @​castrojo in #559
• test(build): add BATS unit tests for 04-install-kernel-akmods.sh by @​castrojo in #548
• fix(ci): rename nvidia-open flavor to nvidia by @​castrojo in #434
• feat(build): conditional initramfs rebuild — skip dracut when kernel unchanged by @​castrojo in #362
• fix(ci): gate nvidia-open promotion on e2e smoke test by @​castrojo in #296
• feat: release notes redesign — variants table, dual kernel, richer components by @​castrojo in #376
• feat(ci): rename bluefin-lts-nvidia → bluefin-lts-hwe-nvidia by @​castrojo in #293
• fix(kernel-swap): run depmod after noscripts install to fix dracut modules.dep error by @​castrojo in #268
• fix(kernel-swap): use tsflags=noscripts + explicit dracut to fix EXDEV by @​castrojo in #263
• fix(kernel-swap): sync ENABLE_GDX → ENABLE_NVIDIA to unblock squash promotion by @​castrojo in #249
• fix(kernel-swap): use dracut.conf.d instead of DRACUT_TMPDIR to fix HWE EXDEV by @​castrojo in #248
• feat: rename bluefin-gdx to bluefin-lts-nvidia, add :stable alias by @​castrojo in #225
• feat(nvidia): wire CDI configuration for rootless Podman GPU passthrough (GDX) by @​castrojo in #209
• fix(build): re-add DRACUT_TMPDIR=/boot workaround for kernel-swap by @​castrojo in #174
• fix(gdx): remove libnvidia-ml from explicit install by @​castrojo in #32
• fix(driver-versions): guard against null pins in hweKernel pinned tooltip by @​castrojo in #933
• feat(sparklines): shared Sparkline component + version trend sparklines on driver versions page by @​castrojo in #969

Dakota (GNOME OS Prototype)​

• fix(nvidia): add OpenCL, VDPAU, and suspend/hibernate support by @​castrojo in #837
• feat(nvidia): Upgrade drivers to 610.43.02 and ship nvidia-settings by @​dylanmtaylor in #643

Infrastructure​

ISO images, upstream integration, build systems, and testing frameworks

Planned Work​

• fix: changelog reads repo from image-info.json and add tests by @​castrojo in #791
• fix(ci): remove continue-on-error incompatible with uses: in e2e.yml by @​castrojo in #787
• ci(renovate): use --auto merge for merge queue on main by @​castrojo in #782
• fix(bonedigger): persist local report copies before cleanup by @​castrojo in #748
• ci: bump testsuite pin to 8d9ca0b (fix common E2E failures) by @​castrojo in #752
• fix(ci): revert to secrets.MERGERAPTOR_APP_ID matching track-common.yml by @​castrojo in #741
• fix(ci): mark notify-downstream continue-on-error by @​castrojo in #740
• fix(ci): use vars.MERGERAPTOR_APP_ID and client-id in notify-downstream by @​castrojo in #739
• fix(ci): remove owner+repositories from create-github-app-token in notify-downstream by @​castrojo in #738
• fix(ci): use workflow_dispatch for bluefin/bluefin-lts common tracking by @​castrojo in #735
• fix(ci): add continue-on-error to dispatch steps by @​castrojo in #734
• fix(ci): dispatch common-updated to dakota after manifest publish by @​castrojo in #733
• ci: bump testsuite pin for custom-command-list checks by @​castrojo in #719
• chore: ponytail shrink — dedup Justfile loops, extract OCI ref check, combine test deps install by @​castrojo in #725
• fix(ci): remove unnecessary mergeraptor token from renovate-automerge; fix vars/secrets inconsistency by @​castrojo in #709
• fix(ci): make downstream dispatch non-blocking by @​castrojo in #698
• fix(ci): login to GHCR before cosign signing in manifest job by @​castrojo in #697
• fix(ci): promote rootless buildah image to root storage before push by @​castrojo in #696
• fix(ci): pass mergeraptor token to reusable automerge workflow by @​castrojo in #694
• fix(keybinding): restore Super+E to open Files (Nautilus) by @​castrojo in #690
• fix(ci): update create-github-app-token to v3 in build.yml by @​castrojo in #688
• feat(report): add crash detection, PII scrubbing, and journal.txt to ujust report by @​castrojo in #684
• fix(tests): remove orphaned uutils.sh tests from test_profile_d.bats by @​castrojo in #674
• fix(update): detect layered rpm-ostree packages and block with guidance by @​castrojo in #663
• fix(ci): restore btrfs storage backend so push-image can find built image by @​castrojo in #661
• fix(ci): skip CVE scan in merge queue to fix SARIF upload ref error by @​castrojo in #660
• test: add unit tests for profile.d scripts, dynamic-wallpaper, and geoclue-latitude by @​castrojo in #648
• test(scripts): add bats coverage for ublue-image-info.sh by @​castrojo in #640
• fix(ci): modernize build pipeline, restore Dakota E2E, event-driven releases by @​castrojo in #598
• ci(tests): upload pytest coverage report as workflow artifact by @​castrojo in #630
• test(just): add bats coverage for update.just and toggle-updates recipes by @​castrojo in #626
• ci(factory): notify downstream repos when common publishes by @​castrojo in #632
• fix(build): P0 — export image to tar before scan-image, non-blocking by @​castrojo in #625
• feat(ci): supply chain hardening — keyless cosign, Trivy CVE gate, SBOM, SLSA L2 (Phase 6) by @​castrojo in #595
• chore(renovate): group projectbluefin/actions ref updates by @​castrojo in #593
• ci: add git-cliff + e2e gate to monthly release workflow by @​castrojo in #592
• test(quality): add bats coverage for ublue-fastfetch, wire into CI by @​castrojo in #579
• test(quality): bats tests for rechunker-group-fix, ublue-bling-fastfetch, changelog.just + coverage gate by @​castrojo in #573
• fix(ujust): route lts/lts-hwe tags to projectbluefin/bluefin-lts in changelogs by @​castrojo in #582
• fix(ci): bump lifecycle-caller SHA to 3025b5d3 (matches bluefin-lts) by @​castrojo in #581
• chore(lifecycle): move lifecycle.yml to projectbluefin/actions by @​castrojo in #574
• feat(testing): expand shellcheck + add bats by @​castrojo in #568
• fix(ci): expand shellcheck to all shell scripts in system_files/ by @​castrojo in #554
• feat: setup VMs for people by @​castrojo in #544
• fix(just): remove rebase-helper and ublue-rollback-helper by @​castrojo in #567
• feat(ci): auto-merge on lgtm label via merge queue by @​castrojo in #555
• feat(ujust): add toggle-testing command by @​castrojo in #535
• feat(testing): add unit tests for hooks.py and shell scripts by @​castrojo in #540
• fix(ci): remove emoji from promotion-candidate E2E failure issue title by @​castrojo in #539
• docs: add upstream-contributions tracking document by @​castrojo in #527
• feat(ci): add AI commit attribution trailer check to validate.yml by @​castrojo in #515
• fix(ci): use client-id and fail fast on missing mergeraptor secrets by @​castrojo in #510
• ci: bump testsuite SHA to e2b36dc (all env + ptyxis quarantine + screenshot fixes) by @​castrojo in #506
• Update curated.yaml: added Ecosia browser in the browser section by @​k3nsh0 in #466
• chore: add Renovate automerge rule for digest/pin/patch/minor updates by @​castrojo in #495
• feat(just): add caffeinate recipe to prevent system sleep by @​hanthor in #351
• fix(ci): close factory determinism gaps in pipeline workflows by @​castrojo in #500
• fix(ci): switch e2e to projectbluefin images, re-enable pr-e2e gate by @​castrojo in #496
• fix(just): return to ujust menu after bbrew and cncf submenus by @​hanthor in #357
• fix(ci): add bonedigger lifecycle workflow by @​castrojo in #490
• fix(ci): add missing RUN for umotd curl and fix pre-commit violations by @​castrojo in #492
• fix: bug batch may23 — toggle-devmode tag, branding update by @​castrojo in #488
• feat(just): ship ujust report via common with Renovate tracking by @​hanthor in #382
• docs(qa): define hardware canary program for post-promotion testing by @​hanthor in #447
• feat(qa): formalize hardware testing into factory loop — template, labels, policy by @​castrojo in #486
• fix(deps): add Renovate config for GHA version tracking by @​castrojo in #485
• feat(ujust): wire flutter devcontainer recipe import by @​castrojo in #356
• feat(just): add check-sb-key recipe for Secure Boot status by @​hanthor in #370
• docs(skills): add frontmatter and Trail of Bits CI integration by @​hanthor in #444
• docs(skills): add frontmatter and Trail of Bits skill-improver CI by @​castrojo in #461
• feat(ci): add common factory guardrails by @​castrojo in #480
• fix(ci): add skill-drift.yml to detect stale agent skills by @​castrojo in #463
• fix(deps): track OCI image digests in Containerfile with Renovate by @​castrojo in #479
• fix(security): pin curl fetches in Containerfile to verified hashes by @​castrojo in #455
• fix(ci): add bonedigger lifecycle workflow by @​castrojo in #453
• fix(docs): add aurorafin-shared and bluefin-branding submodules to AGENTS.md layout by @​castrojo in #454
• docs(skills): update e2e-ci, governance for P0 session 2026-06-03 by @​castrojo in #452
• fix(ci): add hive-progress-sync workflow by @​castrojo in #450
• feat(ci): add pre-merge e2e composition gate for PRs by @​castrojo in #451
• fix(scripts): Check for rpm-ostreed.conf existence before grep by @​dylanmtaylor in #387

Opportunistic Work​

• fix: use generate_sbom_inline for release notes to avoid testing build SBOM OOM by @​castrojo in #740
• fix(ci): pass explicit credentials to reusable-pkg-cadence by @​castrojo in #737
• fix(sbom): add --parallelism 1 to gen-sbom Syft invocation by @​castrojo in #736
• fix(release): use build-time SBOM artifact instead of inline scan by @​castrojo in #730
• fix(ci): exclude main-targeting PRs from remaining pull_request triggers by @​castrojo in #718
• fix(ci): remove pull_request:main triggers that block merge queue by @​castrojo in #717
• fix(release): pass fast_forward_sha to reusable promotion by @​castrojo in #713
• ci(sync): remove BLUEFINBOT dependency from sync-main-to-testing by @​castrojo in #704
• ci(promote): post validate status to unblock merge queue enqueue by @​castrojo in #703
• ci: move to daily releases, remove approval gate by @​castrojo in #702
• feat: release notes redesign — richer key components by @​castrojo in #701
• feat(ci): enable E2E release gate for bluefin by @​castrojo in #693
• fix(ci): correct execute-release commit message trigger pattern by @​castrojo in #686
• fix(ci): add guard against undeclared gitlinks in PR validation by @​castrojo in #685
• fix(agents): revert bluefin-lts branch target to testing by @​castrojo in #673
• test(hooks): add edge-case coverage for setup hook scripts by @​castrojo in #669
• fix(ci): revert to generate_sbom_inline for release notes by @​castrojo in #667
• ci: align testsuite with lts; remove pr-smoke; restore libratbag by @​castrojo in #666
• ci: remove post-testing E2E and issue spam; simplify gate by @​castrojo in #661
• fix(ci): add variants table and mesa to release notes by @​castrojo in #657
• chore(ci): pin testsuite e2e.yml to @v1 by @​castrojo in #654
• ci(promote): weekly Tuesday 04:00 UTC release with conditional auto-merge by @​castrojo in #652
• chore: remove OEM hooks/icons, drop opendyslexic, fix sync token, remove noisy e2e reporter by @​castrojo in #637
• test: add BATS coverage for runtime hook scripts and TAP artifact upload by @​castrojo in #639
• chore: remove OEM hooks now in common, drop opendyslexic RPM, fix sync token by @​castrojo in #614
• fix(ci): switch testsuite ref to @main managed tag by @​castrojo in #629
• fix(ci): add event-driven common digest tracking by @​castrojo in #619
• fix(ci): trigger promote on PR review for zero-touch merge queue enqueue by @​castrojo in #612
• fix(ci): disable e2e gate in promote workflow, fix post-testing-e2e branches filter by @​castrojo in #611
• fix(ci): remove invalid timeout-minutes from post-testing-e2e run-e2e job by @​castrojo in #597
• fix(ci): use inline cosign_identity_regexp to avoid startup_failure by @​castrojo in #596
• fix(ci): fix execute-release trigger and remove unknown reusable inputs by @​castrojo in #594
• ci: kick post-testing-e2e after push-image fix by @​castrojo in #591
• fix(ci): switch bonedigger caller to @main — eliminate SHA drift by @​castrojo in #582
• revert: remove invalid workflows permission scope by @​castrojo in #581
• fix(ci): add workflows write permission to promote caller by @​castrojo in #580
• fix(ci): enable merge queue enqueue for promote PR by @​castrojo in #579
• fix(ci): remove cosign pre-check for common/brew; bump cosign to v3.1.1; fix Renovate SHA pins by @​castrojo in #575
• fix(tests): sync unit tests with removed packages and scripts by @​castrojo in #573
• chore: remove niche/redundant packages and COPR bloat from base image by @​castrojo in #558
• fix(ci): use @v1 managed tag for all projectbluefin/actions refs by @​castrojo in #552
• fix(verify): switch common image verification to keyless Sigstore OIDC by @​castrojo in #561
• refactor(build): extract package arrays to TOML manifest by @​castrojo in #539
• feat(cadence): add pkg-interval cadence tracking by @​castrojo in #537
• chore(ci): use reusable-vulnerability-scan from actions by @​castrojo in #534
• chore(ci): use reusable validate-renovate workflow from actions by @​castrojo in #533
• chore(ci): remove dead lifecycle-caller.yml by @​castrojo in #532
• test: add unit tests for 03-packages.sh and 05-override-install.sh by @​castrojo in #515
• ci: trigger build — v1 tag fixed at 549249ef by @​castrojo in #529
• ci: retrigger Testing Images after v1 tag fix by @​castrojo in #528
• chore(ci): bump actions SHA pin to 549249e (scan-image severity_rank fix) by @​castrojo in #526
• fix(ci): bump actions SHA pin to v1 (6c2278ad) — drop broken 355f162b by @​castrojo in #523
• fix(ci): replace artifact-metadata with issues:write in Testing Images by @​castrojo in #514
• fix(test): run all BATS unit tests in just test-unit by @​castrojo in #509
• fix(ci): enable shellcheck coverage for system_files scripts by @​castrojo in #510
• ci: consumer validation — Design C promotion PR + release notes overflow fix (actions 9e4ba16) by @​castrojo in #508
• fix(ci): auto-close stale e2e failure issues on success by @​castrojo in #504
• test(bats): add 00-image-info.sh unit tests by @​castrojo in #503
• fix(ci): expand promote-testing-to-main permissions for reusable workflow by @​castrojo in #500
• fix(ci): remove duplicate lifecycle caller, fix validate-renovate paths by @​castrojo in #490
• chore(ci): remove per-repo cleanup workflows (centralized in actions) by @​castrojo in #499
• feat(ci): add cliff.toml for structured changelog generation by @​castrojo in #498
• fix(factory): pin @main floating refs to SHA and adopt thin-caller promote by @​castrojo in #496
• ci(promote): replace 343-line promote workflow with thin caller — no more merge friction by @​castrojo in #486
• fix(security): remove dead SCORECARD_TOKEN PAT comment by @​castrojo in #485
• ci(consistency): pin @main reusable-workflow refs to SHA by @​castrojo in #484
• chore(ci): bump projectbluefin/actions SHA pins to 3025b5d31f34 by @​castrojo in #483
• chore(lifecycle): call lifecycle.yml from projectbluefin/actions by @​castrojo in #481
• fix(ci): promotion gate never stalls — e2e fires on testing builds + feedback trigger by @​castrojo in #480
• fix: port several fixes from ublue-os/bluefin by @​castrojo in #475
• feat(build): remove rpm-ostree rechunk, centralize through actions chunka by @​castrojo in #473
• fix(ci): add projectbluefin/ exemption to no-floating-action-tags; remove dead generate-release.yml by @​castrojo in #472
• feat(ci): replace weekly-testing-promotion with PR-based release gate by @​castrojo in #470
• chore: promote testing to main by @​castrojo in #468
• fix(renovate): enable automerge + add image-versions.yml manager for common by @​castrojo in #467
• chore: remove stable branch build workflow by @​castrojo in #461
• chore: remove :latest, :stable-daily, and :gts streams by @​castrojo in #460
• fix(ci): remove environment: production from generate-release by @​castrojo in #454
• fix(ci): restore local generate-release.yml with inline SBOM support by @​castrojo in #451
• fix(ci): bump reusable-release to d290241 — remove secrets: inherit by @​castrojo in #448
• fix(ci): bump reusable-release to beb89cf — add empty secrets block by @​castrojo in #445
• fix(ci): bump reusable-release SHA — drop reserved github_token secret by @​castrojo in #442
• chore: remove rechunker-group-fix duplicate — now in common by @​castrojo in #439
• ci: centralise Renovate and release workflows via projectbluefin/actions reusables by @​castrojo in #438
• ci: remove duplicate scheduled-stable-release workflow by @​castrojo in #436
• ci: add environment:production gate to weekly stable promotion by @​castrojo in #432
• fix(ci): generate SBOM inline with Syft in generate-release by @​castrojo in #431
• fix(ci): tolerate runner preemption and add skopeo fallback in vulnerability-scan by @​castrojo in #430
• fix(ci): bump reusable-release SHA pin and add mergeability poll loop by @​castrojo in #429
• ci: handle missing SBOM in generate-release gracefully by @​castrojo in #425
• ci: use sigstore/cosign-installer in promotion instead of curl by @​castrojo in #422
• ci: fix cosign cert identity regexp in promotion verify by @​castrojo in #417
• ci: fix cosign cert identity regexp in promotion verify by @​castrojo in #414
• ci: remove software suite from weekly promotion e2e by @​castrojo in #410
• chore: promote testing to main by @​castrojo in #409
• fix(ci): unblock stable release — disable lifecycle gate and fix vuln scan by @​castrojo in #406
• fix(ci): allow auto/promote-testing-to-main through base-branch check by @​castrojo in #405
• fix(ci): squash testing commits into single branch for clean promotion PRs by @​castrojo in #402
• fix(ci): correct vulnerability-scan artifact pattern and bonedigger workflow ref by @​castrojo in #399
• fix(ci): disable SBOM in sign-and-publish for testing stream by @​castrojo in #395
• fix(ci): skip SBOM generation for testing stream to unblock builds by @​castrojo in #393
• feat(ci): add sync-main-to-testing workflow by @​castrojo in #389
• fix: centralize scheduled stable release workflow by @​castrojo in #387
• fix(ci): clean up promotion workflows — fix artifact name, stop comment spam, auto-close issues by @​castrojo in #385
• fix(ci): update COPR health monitor to check uupd instead of ublue-update by @​castrojo in #381
• ci: align all reusable-build pins to actions v1 (trivy oci-archive fix) by @​castrojo in #377
• test: pin build-image-testing to actions fix/trivy-oci-archive-scan SHA by @​castrojo in #374
• fix: retain default tag in tag-images so vulnerability scan can find the image by @​castrojo in #372
• feat: add weekly gated stable release on Tuesday by @​castrojo in #371
• feat: migrate generate-release to bootc-build/create-release by @​castrojo in #370
• test(build): add bats unit tests for 17-cleanup.sh and 18-workarounds.sh by @​castrojo in #365
• chore: remove stale 60-custom.just report recipe by @​castrojo in #367
• ci: gate :testing tag behind post-build e2e (#518) by @​castrojo in #369
• test(build): add bats unit tests for clean-stage.sh by @​castrojo in #361
• test(build): add bats unit tests for disable-repos.sh by @​castrojo in #360
• fix(ci): handle FORBIDDEN gracefully in promote-testing-to-main enqueue step by @​castrojo in #358
• fix(ci): replace auto-merge with enqueuePullRequest for main merge queue by @​castrojo in #355
• fix(ci): use GITHUB_TOKEN directly in promote-testing-to-main — remove GitHub App token by @​castrojo in #338
• fix(ci): pin reusable-build to @v1 SHA — retire @fix/sha-skew validation ref by @​castrojo in #353
• chore(ci): validate actions reusable-build SHA normalization by @​castrojo in #342
• feat(ci): enforce PR base branch — require testing, block PRs targeting main by @​castrojo in #349
• ci: validate shared generate-release-notes action by @​castrojo in #344
• test(ci): validate actions pre-commit pinning by @​castrojo in #345
• chore(ci): validate actions timeout pin by @​castrojo in #341
• test(ci): run all bats unit tests in PR validation by @​castrojo in #350
• chore(labels): retire type/* labels in issue templates by @​castrojo in #347
• chore: promote testing to main by @​castrojo in #337
• fix: add promotion conflict reporting and main PR builds by @​castrojo in #334
• chore: switch lifecycle automation to common-owned workflow by @​castrojo in #332
• ci: bump testsuite SHA to e2b36dc (all env + ptyxis quarantine + screenshot fixes) by @​castrojo in #315
• test(build): add bats unit tests for validate-repos.sh and copr-helpers.sh by @​castrojo in #318
• fix(ci): update COPR health monitor for new API response format by @​castrojo in #316
• fix: use app token for promotion PRs by @​castrojo in #328
• ci: add local Renovate runner by @​castrojo in #324
• feat: generate GitHub release after weekly testing promotion by @​castrojo in #325
• ci: automate testing→main branch promotion by @​castrojo in #326
• feat(quality): add bats unit tests for package-lib.sh by @​castrojo in #298
• fix(release): handle bootstrap case when no previous release tag exists [backport #264] by @​castrojo in #265
• fix(ci): handle new GHCR repos in skopeo list-tags version probe by @​castrojo in #281
• fix(ci): scope workflow permissions to job level, drop secrets:inherit by @​castrojo in #297
• fix(ci): harden weekly testing promotion by @​castrojo in #294
• fix(just): stop bootstrapping cosign from unverified container by @​castrojo in #295
• fix(ci): centralize testsuite pin in pr-validation + pin pre-commit version by @​castrojo in #292
• chore: automerge Renovate digest/pin/patch/minor updates when CI passes by @​castrojo in #286
• fix(ci): resolve TOCTOU vuln scan, PR image namespace, testsuite SHA drift by @​castrojo in #250
• fix(ci): centralize testsuite SHA pin through run-testsuite.yml by @​castrojo in #262
• fix(ci): scope weekly-promotion permissions and drop secrets:inherit from build callers by @​castrojo in #255
• fix(release): handle bootstrap case when no previous release tag exists by @​castrojo in #264
• ci: remove E2E smoke test from PR validation by @​castrojo in #285
• fix(security): make base image cosign verify fatal on failure by @​castrojo in #280
• fix(ci): add hive-progress-sync workflow by @​castrojo in #279
• chore: bump upgrade-test.yml SHA to 0527fe28 by @​castrojo in #276
• feat(ci): wire lifecycle upgrade-test into post-build e2e gate by @​castrojo in #275
• fix(ci): replace inline pr-validation steps with validate-pr composite action by @​castrojo in #271
• fix(security): make base image cosign verification fatal in CI by @​castrojo in #244
• ci(hive): add hive-progress-sync workflow by @​castrojo in #243
• feat(ci): add skill-drift wrapper workflow by @​castrojo in #239
• feat: add production environment gate to promotion workflow by @​castrojo in #237
• chore: update centralized actions ref to @v1 by @​castrojo in #234
• feat: port to centralized projectbluefin/actions reusable workflow by @​castrojo in #232
• feat(ci): remove bluefin-dx image variant (retiring) by @​castrojo in #208
• feat(build): split monolithic RUN into cacheable stages for build efficiency by @​castrojo in #198
• feat(ci): enable previous-build delta for rechunking by @​castrojo in #195
• security: pin base image by digest to prevent TOCTOU (CWE-494) by @​castrojo in #191
• fix(build): remove version tag from cache-from/cache-to refs (Podman 5.x compat) by @​castrojo in #196
• feat(ci): auto-file e2e test failures as GitHub issues by @​castrojo in #192
• feat(build): tag large unpackaged assets with user.component for rechunking by @​castrojo in #190
• feat(ci): add preflight job and rechunk metadata verification by @​castrojo in #189
• feat(build): switch SBOM generation from podman-export to oci-dir scan by @​castrojo in #188
• feat(ci): add Grype vulnerability scanning with SARIF upload by @​castrojo in #179
• refactor(ci): extract reusable run-testsuite.yml wrapper workflow by @​castrojo in #185
• refactor(ci): extract composite action for checkout+just bootstrap by @​castrojo in #184
• feat(ci): add PR smoke test gate and Renovate risk-tier automerge by @​castrojo in #187
• feat(ci): implement registry-side layer cache with --cache-from/--cache-to by @​castrojo in #183
• feat(ci): add COPR repository health monitoring by @​castrojo in #182
• security: vendor cosign public keys instead of fetching from mutable URLs by @​castrojo in #180
• chore: remove dead rpm-ostreed.conf and migrate kargs to grubby by @​castrojo in #178
• fix(ci): prevent /e2e dispatch from overwriting canonical :testing tags by @​castrojo in #177
• refactor: read common/brew image refs from image-versions.yml at build time by @​castrojo in #176
• fix(ci): retag tested digest instead of rebuilding for weekly promotion by @​castrojo in #175
• fix(ci): upload SBOM as GitHub Actions artifact for release workflow by @​castrojo in #174
• security: restrict GITHUB_TOKEN to GitHub-owned hosts in ghcurl (CWE-201) by @​castrojo in #172
• fix(ci): pass explicit credentials to reusable-pkg-cadence by @​castrojo in #387
• fix(release): use build-time SBOM artifact instead of inline scan by @​castrojo in #385
• fix(ci): add statuses:write permission to promote workflow by @​castrojo in #384
• fix(release): pass fast_forward_sha to reusable promotion by @​castrojo in #381
• fix(ci): guard post-release-variants against duplicate prepend by @​castrojo in #379
• ci: move to daily releases (04:00 UTC) by @​castrojo in #377
• feat(ci): add E2E gate to post-merge workflow, enable run_e2e for lts by @​castrojo in #369
• fix(ci): pin bonedigger lifecycle.yml SHA instead of floating @v1 tag by @​castrojo in #365
• fix(ci): use build-time SBOM artifact to avoid 2GB inline extraction limit by @​castrojo in #363
• fix(ci): update pkg-cadence comment :lts→:stable by @​castrojo in #353
• fix(ci): guard publish_stream_tag on PR builds; drop main from pr-testsuite by @​castrojo in #352
• ci: align testing-first branch model and drop :lts for :stable by @​castrojo in #351
• ci: remove post-merge E2E gate — promote :testing on successful build by @​castrojo in #342
• fix(ci): restore bonedigger @v1 — tag now exists in projectbluefin/bonedigger by @​castrojo in #341
• fix(ci): revert bonedigger ref to @main — @v1 tag does not exist yet by @​castrojo in #340
• ci(e2e): fix trailing blank line in post-merge-e2e.yml by @​castrojo in #339
• ci(e2e): remove auto-issue-filing on E2E failure by @​castrojo in #338
• chore(renovate): exclude projectbluefin/testsuite from SHA pinning by @​castrojo in #336
• ci(promote): fully automate weekly lts release — no human approval required by @​castrojo in #330
• ci(testsuite): switch run-testsuite.yml from SHA pin to @v1 managed tag by @​castrojo in #328
• ci(pre-commit): exempt projectbluefin/testsuite from floating-tag check by @​castrojo in #327
• chore(ci): pin testsuite e2e.yml to @v1 by @​castrojo in #322
• ci(promote): weekly Thursday 04:00 UTC release with conditional auto-merge by @​castrojo in #320
• fix(ci): exempt projectbluefin/testsuite from floating-tag hook by @​castrojo in #312
• fix(ci): switch testsuite ref to @main managed tag; bonedigger @main → @v1 by @​castrojo in #311
• fix(ci): add event-driven common digest tracking by @​castrojo in #301
• fix(ci): revert bonedigger ref to @main — @v1 tag does not exist by @​castrojo in #295
• feat(ci): add bonedigger lifecycle workflow by @​castrojo in #243
• chore(oem): remove Framework hooks now shipped by common by @​castrojo in #220
• revert: remove invalid workflows permission scope by @​castrojo in #238
• fix(ci): add workflows write permission to promote caller by @​castrojo in #237
• test: add pytest coverage for changelogs.py by @​castrojo in #222
• test: add bats unit tests for build scripts by @​castrojo in #221
• fix(ci): remove racing push trigger, fix stale squash-merge rules by @​castrojo in #236
• fix(ci): align renovate and promote workflows with factory pattern by @​castrojo in #218
• fix(ci): pass base_branch: main to renovate-automerge reusable by @​castrojo in #216
• fix(ci): disable Renovate SHA-pinning for projectbluefin/ actions by @​castrojo in #215
• fix(ci): replace stale testsuite SHA pin with @main by @​castrojo in #211
• fix(ci): use @v1 managed tag for all projectbluefin/actions refs by @​castrojo in #204
• fix(ci): bump actions SHA to e6aaccdf (fix sed title-case in render step) by @​castrojo in #200
• fix(ci): bump actions SHA to 26a4fb2 (squash -X theirs, no conflict issues) by @​castrojo in #198
• fix(ci): use printf to build variants table in execute-release by @​castrojo in #194
• fix(ci): report correct image (bluefin-lts-hwe:testing) in e2e failure issues by @​castrojo in #193
• fix(ci): add missing end-of-file newline to pkg JSON files by @​castrojo in #196
• chore(ci): use reusable-vulnerability-scan from actions by @​castrojo in #179
• chore(ci): use reusable validate-renovate workflow from actions by @​castrojo in #178
• chore(ci): pin floating @v1 tags to SHA in renovate-automerge and release-reminder by @​castrojo in #177
• refactor(build): extract package arrays to TOML manifest by @​castrojo in #182
• feat(cadence): add pkg-interval cadence tracking by @​castrojo in #181
• fix(ci): bump actions SHA pins to @v1 and skip rhc postun in container build by @​castrojo in #173
• fix(ci): fix dead workflow_run triggers on promote-testing-to-main by @​castrojo in #169
• fix(ci): normalize action SHAs, add renovate, remove vestigial workflows by @​castrojo in #164
• feat(ci): add weekly standalone vulnerability scan by @​castrojo in #168
• feat(ci): add cliff.toml for structured changelog generation by @​castrojo in #167
• fix(ci): trigger post-merge-e2e on HWE build, not regular build by @​castrojo in #163
• fix(ci): expand caller permissions to fix promote startup_failure by @​castrojo in #162
• ci(promote): replace 354-line promote workflow with thin caller — no more merge friction by @​castrojo in #161
• ci(consistency): pin @main reusable-workflow refs to SHA by @​castrojo in #159
• fix(ci): set Renovate baseBranchPatterns to testing by @​castrojo in #158
• chore(ci): bump projectbluefin/actions SHA pins to 3025b5d31f34 by @​castrojo in #157
• chore(lifecycle): call lifecycle.yml from projectbluefin/actions by @​castrojo in #156
• fix(ci): promotion gate never stalls — e2e fires on testing builds + feedback trigger by @​castrojo in #155
• fix(ci): remove COPY of nonexistent system_files_overrides/base/ by @​castrojo in #154
• fix(ci): bump testsuite SHA to include udev-settle mask (PR #419) by @​castrojo in #148
• fix(ci): add actions: read to release-notes job to unblock startup_failure by @​castrojo in #141
• fix(ci): add check-trigger regular job before reusable workflow calls by @​castrojo in #140
• fix(ci): grant id-token at workflow level to unblock startup_failure by @​castrojo in #139
• fix(ci): fix YAML syntax error in execute-release if condition by @​castrojo in #138
• fix(ci): change execute-release trigger from pull_request to push by @​castrojo in #137
• feat(build): remove vendored Containerfile.splitter, centralize through actions chunka by @​castrojo in #132
• fix(ci): add mergeability poll loop and close-failure-issue job to promote workflow by @​castrojo in #129
• feat(ci): replace scheduled-lts-release with PR-based release gate by @​castrojo in #128
• fix(deps): bump common + fix Renovate tracking for critical fixes by @​castrojo in #123
• fix(ci): bump projectbluefin/actions SHA to fcd2a6b — fix build failure by @​castrojo in #120
• ci: centralise Renovate and release workflows via projectbluefin/actions reusables by @​castrojo in #118
• ci: fix branch sync direction, Renovate flow, and promotion pipeline by @​castrojo in #117
• ci: scope PR E2E smoke to image content changes only by @​castrojo in #115
• ci: add environment:production gate and fix renovate automerge by @​castrojo in #114
• fix(ci): restore blocking sign-and-publish, unblock Renovate auto-merge, add pre-merge e2e gate by @​castrojo in #111
• fix(ci): skip lts fast-forward when sync-main-to-lts already merged it by @​castrojo in #107
• fix(ci): use always() && needs.X.result on post-promote jobs by @​castrojo in #106
• fix(ci): add explicit if conditions to update-lts-branch and generate-release by @​castrojo in #104
• fix(ci): use lts repo main SHA for promote guard and branch update by @​castrojo in #103
• fix(ci): make upgrade-test non-blocking until testsuite registry check fixed by @​castrojo in #102
• fix(ci): use cosign v3 installer in verify-signatures job by @​castrojo in #101
• fix(ci): broaden cosign cert-identity-regexp to include actions repo by @​castrojo in #100
• feat(ci): replace scheduled rebuild with digest promotion + 7-day floor by @​castrojo in #92
• fix(ci): use PACKAGES_TOKEN for GHCR login in verify-signatures by @​castrojo in #98
• ci: restore sync-main-to-lts workflow by @​castrojo in #97
• chore: promote main → lts (2026-06-06) by @​castrojo in #95
• fix(ci): bump actions SHA — sign-and-publish non-blocking by @​castrojo in #91
• fix: chown sbom_out after sudo gen-sbom so sign-and-publish can write by @​castrojo in #90
• fix(hwe,gdx): dynamically follow Fedora CoreOS stable instead of pinned F43 by @​castrojo in #89
• fix(ci): bump actions SHA — sudo podman inspect fix by @​castrojo in #88
• fix(ci): bump actions SHA — PACKAGES_TOKEN + localhost image refs by @​castrojo in #86
• fix(ci): bump actions SHA — disable Trivy scan blocking release by @​castrojo in #85
• feat(ci): add sync-main-to-testing workflow by @​castrojo in #84
• fix(ci): bump actions SHA — docker format for Trivy archive scan by @​castrojo in #83
• fix(ci): bump projectbluefin/actions SHA to fix Trivy OCI scan by @​castrojo in #82
• fix(justfile): use oci-dir export for SBOM generation by @​castrojo in #81
• fix(ci): remove stale bonedigger.yml duplicate by @​castrojo in #78
• ci: migrate to shared reusable-build.yml; rename images to bluefin-lts/bluefin-gdx by @​castrojo in #73
• fix: add LTS release failure guards by @​castrojo in #70
• feat: parallelize LTS build watching (~5h → ~90min) by @​castrojo in #71
• chore: switch lifecycle automation to common-owned workflow by @​castrojo in #69
• chore: add explicit renovate.json extending org config by @​castrojo in #67
• ci: bump testsuite SHA to e2b36dc (all env + ptyxis quarantine + screenshot fixes) by @​castrojo in #63
• fix: add failure issue auto-filing to LTS post-merge e2e by @​castrojo in #66
• fix: wait for HWE builds and verify cosign signatures in scheduled LTS release by @​castrojo in #65
• fix: remove trailing whitespace from Containerfile by @​castrojo in #59
• chore(ci): add bonedigger.yml lifecycle workflow by @​hanthor in #40
• feat(ci): upgrade podman via resolute, double-push, --compression-level 3, bootc unified storage by @​castrojo in #19
• feat(qa): add post-merge E2E for bluefin-lts by @​hanthor in #41
• feat(ci): migrate to shared projectbluefin/actions by @​castrojo in #46
• fix(ci): add hive-progress-sync workflow by @​castrojo in #44
• feat(ci): adopt validate-pr and detect-changes from projectbluefin/actions by @​castrojo in #37
• ci(hive): add hive-progress-sync workflow by @​castrojo in #28
• feat: migrate reusable-build-image.yml to projectbluefin/actions shared actions by @​castrojo in #23
• chore(lockdown): add CODEOWNERS per-path entries and mandatory gates (Track C-2) by @​castrojo in #26
• feat(ci): production environment gate on LTS release workflow (Track C-1) by @​castrojo in #25
• feat(ci): add skill-drift wrapper workflow by @​castrojo in #24
• Add formula and cask builder by @​jumpyvi in #459
• ci: fix fw-fanctrl python 3.14 bundle by @​ahmedadan in #461
• fix(hive): bypass CORS by fetching registry data at build time by @​castrojo in #956
• feat(hive): fetch all GitHub Search data at build time using GITHUB_TOKEN by @​castrojo in #958
• feat(dakota): add Alpha 3 ISO to downloads testing page by @​castrojo in #931
• feat(hive): org-wide contributor wall + history trends pipeline by @​castrojo in #923
• ci: remove Playwright E2E tests entirely by @​castrojo in #914
• Revert "feat: Bluefin bootc-ISO builder (bootcDirect + containers-storage, 8 GB)" by @​hanthor in #66
• feat: Bluefin bootc-ISO builder (bootcDirect + containers-storage, 8 GB) by @​hanthor in #61
• chore: add CODEOWNERS by @​castrojo in #60
• refactor: modernize template to projectbluefin/actions composite workflow pattern by @​Siddhj2206 in #94
• fix(ci): cosign digest only by @​scrocquesel in #58