@@ -72,6 +72,13 @@
       "groupName": "container image & action digests",
       "schedule": ["before 6am on monday"]
     },
+    {
+      "description": "The Harbor rebuilds reproduce one upstream release, so their build bases follow upstream's Makefile at that tag (GOBUILDIMAGE, NODEBUILDIMAGE) rather than the newest image. A golang tag bump builds Harbor with a toolchain upstream never shipped it with, and a node major breaks the Angular portal build. Tag bumps are disabled here; digest refreshes of the same tag still arrive through the digest group above. Move the tags by hand with HARBOR_VERSION.",
+      "matchManagers": ["dockerfile"],
+      "matchFileNames": ["packages/system/harbor/images/**"],
+      "matchUpdateTypes": ["major", "minor", "patch"],
+      "enabled": false
+    },
     {
       "description": "kubevirt.io/csi-driver is pinned to an untagged pseudo-version commit and publishes no release tags, so Renovate's go datasource returns no-result and the lookup failure lingers on the Dependency Dashboard. Disable it; this module is advanced deliberately alongside the kubevirt-csi-driver image build.",
       "matchManagers": ["gomod"],
 
@@ -208,6 +208,9 @@ jobs:
       # rebuild of any cozystack image.
       - name: Build nocloud disk
         run: make -C packages/core/talos talos-nocloud
+        env:
+          # The e2e sandbox boots amd64 only.
+          PLATFORM: linux/amd64
       - name: Publish disk to GHCR
         env:
           VERSION: ${{ needs.mirror.outputs.version }}
 
@@ -524,6 +524,10 @@ jobs:
         env:
           DOCKER_CONFIG: ${{ runner.temp }}/.docker
           BUILDER: ${{ steps.buildx.outputs.name }}
+          # amd64 only, as in the build job. The arm64 installer needs no QEMU,
+          # but nothing a PR runs boots it. matchbox still gets the arm64 kernel
+          # and initramfs.
+          PLATFORM: linux/amd64
           IMAGE_TAG: pr-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
           PUBLISH_VERSIONED: '0'
           PUBLISH_FLOATING: '0'
 
@@ -181,7 +181,11 @@ jobs:
       # Build project artifacts
       - name: Build
         if: steps.check_release.outputs.release_exists == 'false'
-        run: make build
+        run: |
+          make build
+          # The arm64 assets published below install this image, and building
+          # its arm64 half needs no QEMU, so it is pushed again as both arches.
+          make -C packages/core/talos image-talos PLATFORM=linux/amd64,linux/arm64
         env:
           DOCKER_CONFIG: ${{ runner.temp }}/.docker
           # Cache manifests are registry-portable (oci-mediatypes=true) — read
 
@@ -19,13 +19,16 @@ build: build-deps
 	make -C packages/system/backup-controller image
 	make -C packages/system/backupstrategy-controller image
 	make -C packages/system/lineage-controller-webhook image
+	make -C packages/system/migration-controller image
 	make -C packages/system/flux-shard-operator image
+	make -C packages/system/flux-plunger image
 	make -C packages/system/cilium image
 	make -C packages/system/linstor image
 	make -C packages/system/linstor-gui image
 	make -C packages/system/kubeovn image
 	make -C packages/system/kubeovn-webhook image
 	make -C packages/system/kubeovn-plunger image
+	make -C packages/system/kilo image
 	make -C packages/system/dashboard image
 	make -C packages/system/metallb image
 	make -C packages/system/talos-log-collector image
@@ -38,7 +41,10 @@ build: build-deps
 	make -C packages/system/securitygroup-controller image
 	make -C packages/system/grafana-operator image
 	make -C packages/system/redis-operator image
+	make -C packages/system/harbor image
+	make -C packages/system/velero image
 	make -C packages/system/opensearch-operator image
+	make -C packages/system/keycloak-operator image
 	make -C packages/core/testing image
 	make -C packages/core/talos image
 	make -C packages/core/platform image
 
@@ -44,7 +44,7 @@ If a package stamps a reference somewhere the two globs do not cover, add that f
 
 - **Every first-party reference is tag+digest.** A bare tag with no digest is not reproducible and must not be committed. `securitygroup-controller:v0.0.0` is a live violation.
 - **Exactly one producer stamps each reference.** A reference no `Makefile` writes will never be refreshed by anything, including release preparation — `chBackupClientImage` in `packages/system/backupstrategy-controller/values.yaml` is a live violation, still pinned to `platform-migrations:v1.4.0-rc.2`.
-- **A package that stamps a reference is in the root `Makefile` `build:` list.** `build-matrix.sh`, the main build and release preparation all iterate that one list, so a package outside it is never rebuilt by any path and its pin freezes permanently. `flux-plunger`, `keycloak-operator` and `kilo` are live violations (tracked in #3416).
+- **A package that stamps a reference is in the root `Makefile` `build:` list.** `build-matrix.sh`, the main build and release preparation all iterate that one list, so a package outside it is never rebuilt by any path and its pin freezes permanently. `hack/build-matrix_test.bats` computes the set of packages whose Makefile runs `docker buildx build` and fails on any the list misses.
 - **Every consumer of references reads all three storage shapes**, via `hack/lib/image-refs.sh`.
 - **Scan wider than you rewrite.** A rewrite is deliberately narrow to avoid corrupting vendored defaults, so the check that follows it must not share that blind spot. `hack/promote-rewrite-tags.sh` rewrites the enumerated files, then greps the whole tree and fails if any reference to the release candidate survives.
 
@@ -65,13 +65,13 @@ Two rows do not source the shared library, for opposite reasons. `hack/overlay-m
 
 ## Known gaps
 
-These are real, currently unfixed, and predate the shared enumeration. They are recorded here so nobody rediscovers them as surprises.
+These predate the shared enumeration. Each entry says whether the tree works around it today; they are recorded here so nobody rediscovers them as surprises.
 
-**The nightly host rewrite cannot reach a host split across two keys.** The primary pass is a literal `<src-registry>/` substring replace, so it only rewrites a reference whose host sits contiguously in front of the repository. Two layouts defeat it, and only one is now handled.
+**The nightly host rewrite cannot reach a host split across two keys.** The primary pass is a literal `<src-registry>/` substring replace, so it only rewrites a reference whose host sits contiguously in front of the repository. Two layouts in the tree defeated it; one is handled by a second expression and the other was removed from the tree.
 
 `kubeovn` puts the whole host in `global.registry.address` with the bare repository in a sibling key, so there is no trailing slash to match. This one **is** rewritten now, by a second, end-of-line-anchored expression that fires only when the source registry is the complete scalar value — a contiguous `<src>/<repo>@<digest>` ref continues past the host, so the two expressions can never both fire on one reference. It had to be fixed when kubeovn's image build moved into this repository: until then the image was built and pushed to the public registry by cozystack/kubeovn-chart, the baked ref kept the committed public-registry host, and the ownership filter skipped it. The moment a CI build stamps the build-registry host into that key, the image is mirrored but the host is not rewritten, and the published tree points at the private build registry. Covered by `hack/nightly-mirror_test.bats`.
 
-`keycloak-operator` remains unfixed. It splits at a different boundary — `registry: iad.ocir.io` beside `repository: idyksih5sir9/cozystack/<name>` — so neither key holds the source registry as a whole and no anchored replace can reach it; rewriting it needs a structure-aware pass that knows how the destination host splits. The gap stays dormant because no CI path rebuilds the package (#3416), and turns live the moment one does.
+`keycloak-operator` split at a different boundary: `registry: ghcr.io` beside `repository: cozystack/cozystack/<name>`, with an `image:` target that stamped only `tag`. A CI build would have rendered the committed public host with a digest that exists only in the build registry, and stamping the build host into `registry` instead would spread the source registry across two keys (`iad.ocir.io` and `idyksih5sir9/cozystack/<name>`), where no anchored replace can reach it. Rather than a structure-aware rewrite pass, the package now sets `registry: ""` and keeps the whole host in `repository`, which renders the same image string because the upstream chart joins the two keys, and its `image:` target stamps `repository` the same way. The rewrite still cannot reach a host split at that boundary, so a package must not stamp one: keep the host inside `repository`, or make it the complete value of its key as kubeovn does. Covered by `hack/nightly-mirror_test.bats`.
 
 Collection understands both shapes — the host is rejoined, so a split-key ref carrying the source-registry host is still selected and mirrored. This is a defect in the host dimension; the version dimension the promote rewrite handles is unaffected, because the version always lives in a `tag` key regardless of where the host is.
 
 
@@ -94,7 +94,7 @@ Build environment variables:
 - `REGISTRY` — Docker registry (default `ghcr.io/cozystack/cozystack`).
 - `PUSH=1` / `LOAD=0` — control buildx push/load behaviour.
 - `LOAD=1 PUSH=0` — load images locally instead of pushing. Builds for the host architecture only, because the classic docker image store cannot load a multi-platform index.
-- `PLATFORM` — the buildx platforms. Defaults to `linux/amd64,linux/arm64` for anything but `LOAD=1`, so a push from either architecture publishes an index both can run. Needs a `docker-container` builder (`BUILDER`) or a docker daemon on the containerd image store, with QEMU registered for the non-native half. Compiling builder stages run natively on `$BUILDPLATFORM` and cross-compile for the target, but every `RUN` step of a stage that runs on the target platform (package installs, `setcap`, install scripts, patch steps) still runs emulated. `packages/core/talos` and `packages/core/testing` pin `linux/amd64`, because they carry amd64-only payloads: the Talos assets and an x86 KVM sandbox.
+- `PLATFORM` — the buildx platforms. Defaults to `linux/amd64,linux/arm64` for anything but `LOAD=1`, so a push from either architecture publishes an index both can run. Needs a `docker-container` builder (`BUILDER`) or a docker daemon on the containerd image store, with QEMU registered for the non-native half. Compiling builder stages run natively on `$BUILDPLATFORM` and cross-compile for the target, but every `RUN` step of a stage that runs on the target platform (package installs, `setcap`, install scripts, patch steps) still runs emulated. `packages/core/testing` pins `linux/amd64`, because it carries an x86 KVM sandbox. `packages/core/talos` builds the Talos installer and release assets for the arches in `PLATFORM` with the upstream imager, which needs no QEMU for either; its matchbox image carries the amd64 and arm64 kernel and initramfs whatever `PLATFORM` says, because it network-boots machines of either arch.
 
 ### Values schema generation
 
 
@@ -156,3 +156,26 @@
   actual=$(echo "$out" | jq 'length')
   [ "$expected" -eq "$actual" ]
 }
+
+@test "every package that builds an image is in the build list" {
+  # The build list is maintained by hand, and a package missing from it is
+  # rebuilt by no CI path: its Dockerfile and patches keep changing while the
+  # pinned image stays whatever was last pushed by hand. Derive the set from
+  # the package Makefiles so a new image target cannot be forgotten.
+  listed=$(sed -n '/^build:/,/^[^[:space:]]/p' Makefile \
+    | grep -oE 'make -C packages/[A-Za-z0-9._/-]+ image' \
+    | sed -E 's/^make -C (packages[^ ]+) image$/\1/')
+  missing=""
+  checked=0
+  for m in packages/*/*/Makefile; do
+    grep -q 'docker buildx build' "$m" || continue
+    checked=$((checked + 1))
+    d=${m%/Makefile}
+    printf '%s\n' "$listed" | grep -qx "$d" || missing="$missing $d"
+  done
+  [ "$checked" -gt 0 ]
+  if [ -n "$missing" ]; then
+    echo "image-building packages missing from the root Makefile build: list:$missing" >&2
+    false
+  fi
+}
@@ -119,3 +119,17 @@
   echo "$out" | grep -q -- '--load=1'
   if echo "$out" | grep -q -- '--platform'; then echo "FAIL: LOAD=1 passes a platform, so buildx builds an index it cannot load"; false; fi
 }
+
+@test "talos pushes one installer index for PLATFORM and matchbox boots both arches" {
+  # -B prints every asset build whether or not a local _out/assets has it.
+  out=$(make -n -B -C packages/core/talos image IMAGE_TAG=pr-1-abc COZYSTACK_VERSION=0 BUILDER=b)
+  echo "$out" | grep -q 'for a in amd64 arm64; do skopeo copy'
+  echo "$out" | grep -q 'hack/installer-index.sh [^ ]* amd64 arm64;'
+  echo "$out" | grep -q 'skopeo copy --all "$SRC" docker://[^ ]*/talos:pr-1-abc'
+  # The installer follows PLATFORM, but matchbox serves machines of either arch
+  # wherever it runs, so it still needs the arm64 kernel and initramfs.
+  out=$(make -n -B -C packages/core/talos image IMAGE_TAG=pr-1-abc COZYSTACK_VERSION=0 BUILDER=b PLATFORM=linux/amd64)
+  if echo "$out" | grep -q 'installer-arm64'; then echo "FAIL: an amd64 build builds the arm64 installer"; false; fi
+  echo "$out" | grep -q 'profiles/kernel-arm64.yaml'
+  echo "$out" | grep -q 'profiles/initramfs-arm64.yaml'
+}
@@ -27,11 +27,12 @@ REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
 
 # Outputs with no architecture, one entry per line: a whole file, or
 # "<file>:<stage>" when only that stage is neutral and the file's other
-# stages still have to target TARGETARCH. The console and shadowbox's webpack
-# stage build static JS; piraeus-server builds Java .debs that
-# linstor-server's debian/control declares `Architecture: all`.
+# stages still have to target TARGETARCH. The console, the Harbor portal and
+# shadowbox's webpack stage build static JS; piraeus-server builds Java .debs
+# that linstor-server's debian/control declares `Architecture: all`.
 ARCH_NEUTRAL="packages/apps/vpn/images/shadowbox/Dockerfile:app
 packages/system/dashboard/images/console/Containerfile
+packages/system/harbor/images/harbor-portal/Dockerfile
 packages/system/linstor/images/piraeus-server/Dockerfile"
 
 # is_neutral <file> <stage> <list>: 1 when the list names the file or that stage of it.