[patch] Use managed Vault Init publication

.github/workflows/github-release.yaml

@@ -8,7 +8,7 @@ on:
 jobs:
   release:
     if: github.event.pull_request.merged == true && !contains(github.event.pull_request.title, 'skip-release')
-    uses: libops/.github/.github/workflows/bump-release.yaml@d5a29840172a53729c5999832534de65b7ba9587
+    uses: libops/.github/.github/workflows/bump-release.yaml@main
     with:
       workflow_file: goreleaser.yaml
     permissions:

.github/workflows/lint-test-build-push.yml

@@ -54,42 +54,35 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner:
-          - ubuntu-24.04
-          - ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
+        architecture:
+          - runner: ubuntu-24.04
+            platform: linux/amd64
+            suffix: amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            suffix: arm64
+    runs-on: ${{ matrix.architecture.runner }}
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
           persist-credentials: false
 
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
 
-      - name: Resolve native platform
-        id: platform
-        run: |
-          set -euo pipefail
-          case "$RUNNER_ARCH" in
-            X64) platform=amd64 ;;
-            ARM64) platform=arm64 ;;
-            *) echo "Unsupported runner architecture: $RUNNER_ARCH" >&2; exit 1 ;;
-          esac
-          echo "name=$platform" >> "$GITHUB_OUTPUT"
-
       - name: Build native image without credentials
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
         with:
           context: .
           load: true
-          platforms: linux/${{ steps.platform.outputs.name }}
+          platforms: ${{ matrix.architecture.platform }}
           provenance: false
           push: false
-          tags: vault-init:ci-${{ steps.platform.outputs.name }}
+          tags: vault-init:ci-${{ matrix.architecture.suffix }}
 
       - name: Scan native image
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
-          image-ref: vault-init:ci-${{ steps.platform.outputs.name }}
+          image-ref: vault-init:ci-${{ matrix.architecture.suffix }}
           format: table
           exit-code: "1"
           ignore-unfixed: true
@@ -101,22 +94,21 @@ jobs:
     needs:
       - test
       - image-check
-    uses: libops/.github/.github/workflows/pr-status.yaml@d5a29840172a53729c5999832534de65b7ba9587
+    uses: libops/.github/.github/workflows/pr-status.yaml@main
     permissions: {}
     with:
       needs-json: ${{ toJSON(needs) }}
 
   publish:
     if: github.event_name != 'pull_request'
     needs: test
-    uses: libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587
+    uses: libops/.github/.github/workflows/build-push.yaml@main
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
       additional-gar-registry: us-docker.pkg.dev/libops-images/public
       scan: true
       sign: true
-      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587
     permissions:
       contents: read
       id-token: write