-
Take bentos sando bearer token from the environment, not a file
-
Carry a finished artifact from Bento to Sando
-
Land every build's artifacts at one address on astra
-
Key each step log on its run id
-
Add a Bento service kind that deploys onto the host that runs it
-
bento: cover the macOS sign/notarize/staple execution chain
-
bento: pin every build host to one sha before building (audit e5f48171)
-
bento: close the seven release-orchestration audit findings