Update cicd

Adding GHCR to CI/CD Release Workflow & further improvements

.github/workflows/cicd.yml

@@ -25,7 +25,7 @@ concurrency:
 jobs:
   release:
     name: Build and Release
-    runs-on: ubuntu-latest
+    runs-on: amd64-runner
     # Job-level timeout to avoid runaway or stuck runs
     timeout-minutes: 120
     env:
@@ -78,13 +78,6 @@ jobs:
           echo "Built & pushed to: ${{ env.DOCKERHUB_IMAGE }}:${TAG}"
         shell: bash
 
-      - name: Login in to GHCR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Install skopeo + jq
         # skopeo: copy/inspect images between registries
         # jq: JSON parsing tool used to extract digest values
@@ -94,6 +87,11 @@ jobs:
           skopeo --version
         shell: bash
 
+      - name: Login to GHCR
+        run: |
+            skopeo login ghcr.io -u "${{ github.actor }}" -p "${{ secrets.GITHUB_TOKEN }}"
+        shell: bash
+
       - name: Copy tag from Docker Hub to GHCR
         # Mirror the already-built image (all architectures) to GHCR so we can sign it
         run: |

.github/workflows/test.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: amd64-runner
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

README.md

@@ -135,6 +135,7 @@ All CLI arguments can be set using environment variables as an alternative to co
 -   `TLS_CLIENT_CERT`: Path to client certificate for mTLS (equivalent to `--tls-client-cert`)
 -   `TLS_CLIENT_KEY`: Path to private key for mTLS (equivalent to `--tls-client-key`)
 -   `TLS_CA_CERT`: Path to CA certificate to verify server (equivalent to `--tls-ca-cert`)
+-   `SKIP_TLS_VERIFY`: Skip TLS verification for server connections. Default: false
 
 ## Loading secrets from files