docs: post-0.1.0 cleanup — container badges, release-runbook fixes

[cuioss-oliver]

Follow-up to the 0.1.0 release. Documentation and agent-instruction only — no build inputs touched, so the Maven gate is skipped under the CLAUDE.md rule this PR also introduces.

README

Added a Container Image badge group: GHCR version, Release workflow status, Cosign-signed and Trivy-gate.

The version badge carries ignore=sha-%2A%2Csha256-%2A and that filter is load-bearing. Without it the newest tag on the package is the Cosign signature artifact, and the badge renders sha256-937b3995… as though it were the release version — verified against the live service before choosing the URL. The asterisks and comma are percent-encoded so AsciiDoc cannot read *…* as bold markup or the comma as an attribute separator; both encodings were confirmed accepted by the badge service.

Trivy and Cosign have no dynamic badge source — nobody hosts scan/signature status as live data — so those two are static claim badges linking to the docs that carry the verification commands. The Release-workflow badge is GitHub-native and genuinely live.

Removed the Coordinate history note. The de.cuioss.sheriff.api abandonment no longer helps a reader arriving at the project; the incident account survives in the release skill and the resulting decision in ADR-0034. The skill's dangling cross-reference to that note was repointed.

All README links verified to resolve (200), including the now-public GHCR package page.

Examples and operator docs

• deployment/compose-sample/.env — dropped the 0.1.0 is not published yet caveat. It was accurate when written, false the moment the release landed, and directly contradicted by the image pin one line below it.
• doc/user/container-image.adoc — recorded that internal is not public. Internal grants every org member a pull while anonymous consumers still get 401, so a maintainer's check succeeds exactly when an outside user's fails.

Release skill

Two defects found while cutting 0.1.0, both fixed and both validated by running the corrected commands:

• Step 2 stubs check self-pruned. git fetch origin release/relocation-stubs:refs/remotes/… deletes the tracking ref under fetch.prune=true, so the guard reported ERROR: the check did not evaluate for a branch present on the remote at 67c8339b. Now uses the fully-qualified forced refspec; verified prune-idempotent across two consecutive runs.
• Step 9 landed on internal. Every authenticated check — docker pull, imagetools inspect, cosign verify — passes on an internal package, so the natural checks all confirmed the wrong thing while anonymous pulls 401'd for ~150s of polling that looked like propagation lag. Now asserts the visibility field; the guard's negative control was verified to exit non-zero on internal.

Also added Step 10 — update the version-bearing examples (subsequent steps renumbered), and recorded in Step 11 that the initial release gets no changelog at all.

CLAUDE.md

Scoped the pre-commit build gate to commits touching build inputs, with documentation-only defined by explicit file classes. States that a mixed commit is not exempt — one Java file in an otherwise-prose change subjects the whole commit to the gate — and that doubt resolves toward running it.

Release notes

Separately (not in this diff): the 0.1.0 GitHub release notes were rewritten. The generated 152-PR changelog was dropped whole in favour of a short statement of what the project is, what ALPHA means for surface stability, how to get the artifact, and where the docs are — everything is new at an initial release, so a per-PR list is build history rather than release information. All links in the new notes verified.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PzQHLRpqwW42aCAemAc23G

Summary by CodeRabbit

• Documentation
  • Added container image status badges for GHCR, releases, Cosign, and Trivy.
  • Clarified that published container images must have Public visibility for anonymous access.
  • Expanded container-image troubleshooting and updated sample environment guidance.
  • Removed outdated Maven coordinate-history information.
  • Strengthened release verification and reporting guidance, including initial-release notes handling.
• Chores
  • Clarified when pre-commit checks are required based on the files changed.

[sourcery-ai]

Sorry @cuioss-oliver, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: cuioss/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bbd244e1-5350-4e9a-9527-bf473ff7d197

📥 Commits

Reviewing files that changed from the base of the PR and between 47977e9 and 32af89f.

📒 Files selected for processing (5)

• .claude/skills/release/SKILL.md
• CLAUDE.md
• README.adoc
• deployment/compose-sample/.env
• doc/user/container-image.adoc

---

📝 Walkthrough

Walkthrough

This PR updates release and repository guidance. It tightens GHCR public-visibility verification, strengthens relocation-stub safety rules, revises release reporting and initial-release notes handling, aligns container image references in docs, and limits full pre-commit checks to build-affecting commits.

Changes

Release and container publication guidance

Layer / File(s)	Summary
Release guardrails and reporting .claude/skills/release/SKILL.md	The runbook now uses a fully-qualified forced refspec for relocation-stub checks, adds a first-release exception for release-note reformatting, expands the final report checklist, updates critical rules, and revises the incident note in “See also”.
GHCR visibility verification .claude/skills/release/SKILL.md, doc/user/container-image.adoc	The runbook now requires Public (not Internal) package visibility, checks the GHCR visibility field with gh api, adds an anonymous docker pull proof path, and treats empty digest results as failure when the package is still private or internal. The user doc now states that only public supports anonymous pulls.
Published image references .claude/skills/release/SKILL.md, README.adoc, deployment/compose-sample/.env	The runbook now delays version-bearing example updates until image verification and public visibility are complete, adds grep-based enumeration, and requires reporting whether files changed or were already correct. The README adds container image status badges, and the sample compose env now states that the pinned image must already exist.

Commit validation policy

Layer / File(s)	Summary
Pre-commit scope rules CLAUDE.md	The pre-commit policy now requires the full quality gate and verification flow only for build-affecting commits. Documentation-only commits are exempt. Mixed or uncertain commits still require the full process.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• cuioss/API-Sheriff#158: Both PRs change the release runbook rules for GHCR visibility and release verification.
• cuioss/API-Sheriff#145: Both PRs update GHCR publication guidance in the release runbook and doc/user/container-image.adoc.
• cuioss/API-Sheriff#150: Both PRs touch deployment/compose-sample guidance for published GHCR image usage.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the documentation cleanup, container badges, and release-runbook fixes described in the changeset.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cuioss-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected