release: prepare Python 0.2.2 and collector 0.2.1

.github/workflows/ci.yml

@@ -33,7 +33,9 @@ jobs:
       - name: Install dev deps
         run: |
           python -m pip install --upgrade pip
-          pip install -e ".[dev,k8s]"
+          pip install --require-hashes -r dev-requirements.txt
+          pip install -e ".[k8s]"
+          pip check
 
       - name: Lint (flake8)
         run: flake8 --per-file-ignores=l9gpu/_version.py:F401 l9gpu
@@ -63,7 +65,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version: "1.27.3"
           cache-dependency-path: ${{ matrix.module }}/go.sum
 
       - run: go mod download
@@ -78,8 +80,8 @@ jobs:
           working-directory: ${{ matrix.module }}
           args: --timeout=5m
           # golangci-lint v1.64 ships with Go 1.24 — skip lint until a
-          # newer release supports the Go 1.25 toolchain required by the
-          # upstream OTel collector v0.150 dependencies.
+          # newer release supports the Go 1.27 toolchain used for the
+          # crypto/x509 eMudhra certificate blocklist.
         continue-on-error: true
 
   helm:
@@ -168,7 +170,7 @@ jobs:
 
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.25"
+          go-version: "1.27.3"
 
       - name: Install OpenTelemetry Collector Builder
         env:

.github/workflows/collector-release.yml

@@ -15,7 +15,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  GO_VERSION: "1.25"
+  GO_VERSION: "1.27.3"
   OCB_VERSION: "v0.150.0"
 
 jobs:
@@ -44,7 +44,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/go/bin/builder
-          key: ocb-${{ runner.os }}-${{ env.OCB_VERSION }}
+          key: ocb-${{ runner.os }}-${{ env.GO_VERSION }}-${{ env.OCB_VERSION }}
 
       - name: Install OpenTelemetry Collector Builder
         if: steps.cache-ocb.outputs.cache-hit != 'true'
@@ -110,6 +110,7 @@ jobs:
           case "$SEMVER" in *-*) prerelease_flag="--prerelease" ;; esac
           if gh release view "$FULL_TAG" >/dev/null 2>&1; then
             gh release upload "$FULL_TAG" dist/*.tar.gz dist/checksums.txt --clobber
+            gh release edit "$FULL_TAG" --draft=false
           else
             gh release create "$FULL_TAG" \
               --title "l9gpu-collector ${SEMVER#v}" \

.github/workflows/release.yml

@@ -51,9 +51,48 @@ jobs:
 
       - uses: pypa/gh-action-pypi-publish@release/v1
 
+  publish-image:
+    name: Publish Python runtime image
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: image
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: type=semver,pattern={{version}}
+
+      - name: Build and publish fresh runtime images
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          pull: true
+          no-cache: true
+          push: true
+          tags: ${{ steps.image.outputs.tags }}
+          labels: ${{ steps.image.outputs.labels }}
+
   github-release:
     name: Create GitHub release
-    needs: publish-pypi
+    needs: [publish-pypi, publish-image]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -72,7 +111,12 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
         run: |
-          gh release create "$TAG" \
-            --title "$TAG" \
-            --generate-notes \
-            dist/*
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            gh release upload "$TAG" dist/* --clobber
+            gh release edit "$TAG" --draft=false
+          else
+            gh release create "$TAG" \
+              --title "$TAG" \
+              --generate-notes \
+              dist/*
+          fi

SECURITY.md

@@ -37,3 +37,39 @@ Out of scope:
 - Vulnerabilities requiring physical access to GPU nodes or root on the host
 
 Thank you for helping keep the project and its users safe.
+
+## eMudhra trust-store updates (October 2026)
+
+Python installations require `certifi>=2026.10.19`. The development lockfile
+also includes patched `pip>=26.2.2`, which carries its own CA bundle. Go
+modules and collector builds require Go 1.27.3 or newer. See the
+[incident and patched-version list](https://emudhra.we-have-a-problem.com/)
+and the [Go security announcement](https://groups.google.com/g/golang-announce/c/66pojueaQek).
+
+After installing the locked dependencies, run this network smoke check:
+
+```bash
+python scripts/check_tls_trust.py
+```
+
+It must accept a trusted HTTPS endpoint and reject both the direct and
+cross-signed compromised test chains with certificate verification errors.
+Connection failures do not count as successful rejection. Add `--system` to
+check the host or container system CA bundle too.
+
+Rebuild Python and collector release artifacts with the updated dependencies
+and Go compiler before publishing a new release. Rebuild container images
+with `--pull --no-cache` to refresh base-image CA bundles and dependency
+layers; existing images and installed packages do not receive these changes
+automatically. The Python image refreshes Debian's `ca-certificates` package
+in both stages. Verify a rebuilt Python image before publishing:
+
+```bash
+docker build --pull --no-cache -f docker/Dockerfile -t l9gpu:tls-check .
+docker run --rm --entrypoint python \
+  -v "$PWD/scripts:/checks:ro" l9gpu:tls-check \
+  /checks/check_tls_trust.py --system
+```
+
+Publish rebuilt packages and images through the normal release workflows.
+Do not disable certificate verification to restore connectivity.

deploy/collector/builder-config.yaml

@@ -7,7 +7,7 @@ dist:
   name: l9gpu-collector
   description: OpenTelemetry Collector distribution with l9gpu processors bundled
   output_path: ./_build
-  version: 0.1.0
+  version: 0.2.1
 
 extensions:
   - gomod: go.opentelemetry.io/collector/extension/zpagesextension v0.150.0