From 299439c72aa5e0061b137270856df18079294f89 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Tue, 27 Oct 2026 16:07:30 -0400
Subject: [PATCH 1/2] fix(release): lock the Go 1.27.3 warehouse gateway for
 0.0.4

---
 README.md          | 4 ++++
 gateway-image.json | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index cf7a7aa..de10674 100644
--- a/README.md
+++ b/README.md
@@ -128,6 +128,10 @@ as `codefly.dev/object-storage`. The agent is the repo-root `main` package
 declared by [`agent.codefly.yaml`](agent.codefly.yaml); it is released as a GitHub
 release asset a consumer pins by version. The gateway it runs is a container
 image, pinned by digest in [`gateway-image.json`](gateway-image.json).
+The current lock was rebuilt with Go 1.27.3 for the upcoming 0.0.4 release by
+[publisher run 40574049417](https://github.com/codefly-dev/service-warehouse/actions/runs/40574049417),
+from merged source `e6aa5185187a2548919456c8b614e8807d6916b1`. Both gateway
+architectures are checked through the published-image CI scan before release.
 
 **What a consumer receives.** The configuration group `warehouse`, with
 `connection` (`grpc://host:port`), `endpoint` (`host:port`) and `token`, a
diff --git a/gateway-image.json b/gateway-image.json
index ba2451f..84f70db 100644
--- a/gateway-image.json
+++ b/gateway-image.json
@@ -1,4 +1,4 @@
 {
   "name": "ghcr.io/codefly-dev/service-warehouse",
-  "digest": "sha256:9f04716e902697027f39b21bdc48b3e867e66447a37bf096ff7c8c146659d7c8"
+  "digest": "sha256:e6d817279f123abf277173ab2d46b5173300cb642e4c2350c3add3462fdcc567"
 }

From 7d7c529bcaa6e3259987f596c76da040a6eb8cc4 Mon Sep 17 00:00:00 2001
From: Antoine Toussaint
 <312536060+antoinetoussaint-byte@users.noreply.github.com>
Date: Tue, 27 Oct 2026 16:07:59 -0400
Subject: [PATCH 2/2] docs: keep gateway build provenance valid after
 publication

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index de10674..7c2af44 100644
--- a/README.md
+++ b/README.md
@@ -128,7 +128,7 @@ as `codefly.dev/object-storage`. The agent is the repo-root `main` package
 declared by [`agent.codefly.yaml`](agent.codefly.yaml); it is released as a GitHub
 release asset a consumer pins by version. The gateway it runs is a container
 image, pinned by digest in [`gateway-image.json`](gateway-image.json).
-The current lock was rebuilt with Go 1.27.3 for the upcoming 0.0.4 release by
+The current lock was rebuilt with Go 1.27.3 for release 0.0.4 by
 [publisher run 40574049417](https://github.com/codefly-dev/service-warehouse/actions/runs/40574049417),
 from merged source `e6aa5185187a2548919456c8b614e8807d6916b1`. Both gateway
 architectures are checked through the published-image CI scan before release.