Agentic Sandbox v2026.7.11

Agentic Sandbox v2026.7.11

Released: 2026-07-12 Tag: `v2026.7.11` Previous: `v2026.7.10` Compare: `v2026.7.10...v2026.7.11`

What this release is

A CI/docs release. The runtime is identical to v2026.7.10 — same binaries, same behavior. This bump re-runs the full release pipeline to verify it end to end now that CI secrets come entirely from vault and non-secret config comes from Gitea variables, and it adds automatic Cloudflare cache purging when docs are published.

Highlights

  • Docs publish now busts the cache. After deploying docs to

`docs.aiwg.io/agentic-sandbox/`, CI fetches the Cloudflare token from vault and purges the subpath (scoped to the tenant, batched 30/request) so readers get new docs immediately instead of waiting on the cache TTL.

  • Non-secret CI config → Gitea variables. `DOCSITE_DEPLOY_HOST/PATH/PORT/USER` are

now repository variables; only secret-zero (`VAULT_*`), the Cloudflare zone id, and vault-sourced key material remain Actions secrets.

  • Pure-vault verification. Every publication path — internal registry, GHCR

mirror, GitHub mirror, docsite deploy + purge, and GPG tarball signing — runs on the vault AppRole with nothing sensitive left in the tracker.

Verification

# import the release public key (unchanged since v2026.7.10)
curl -fLO "https://raw.githubusercontent.com/jmagly/agentic-sandbox/main/docs/releases/keys/agentic-sandbox-release-key.asc"
gpg --import agentic-sandbox-release-key.asc   # expect 9292EFCB…E09C33

docker pull ghcr.io/jmagly/agentic-sandbox-mgmt:v2026.7.11
gpg --verify agentic-sandbox-v2026.7.11-x86_64-linux-gnu.tar.gz.asc \
             agentic-sandbox-v2026.7.11-x86_64-linux-gnu.tar.gz

Full notes: `CHANGELOG.md` `[2026.7.11]`.