docs: record published 2026.10.12-r1 images

CHANGELOG.md

@@ -18,8 +18,9 @@
 
 ### Release status
 
-- Prepared for publication as `2026.10.12-r1`. `2026.09.10-r1` remains the
-  previous verified release until both registries and release evidence pass.
+- Published to Docker Hub and GHCR as matching five-platform indexes at
+  `sha256:e060cc1abb7940bb2e50c4e54ded85b6dbd7fd66d7361f249180d36125e9e373`.
+  Per-platform SBOM, provenance, and both registry signatures passed verification.
 
 ### Upgrade notes
 

README.md

@@ -4,15 +4,11 @@
 
 WordPress with SQLite, ready to use out of the box.
 
-<!-- release-availability: pending -->
-> **Container release availability:** `2026.10.12-r1` is prepared but is not
-> published yet as a verified container image. The previous verified release,
-> [`2026.09.10-r1`](https://github.com/soulteary/docker-sqlite-wordpress/releases/tag/2026.09.10-r1),
-> remains available from Docker Hub and GHCR. Until the protected
-> `2026.10.12-r1` tag succeeds in both registries, build current `main` as
-> shown in Quick Start. The existing `latest` alias still represents the
-> previous release.
-
+> **Published container release:** [`2026.10.12-r1`](https://github.com/soulteary/docker-sqlite-wordpress/releases/tag/2026.10.12-r1)
+> is available from Docker Hub and GHCR as matching five-platform indexes at
+> `sha256:e060cc1abb7940bb2e50c4e54ded85b6dbd7fd66d7361f249180d36125e9e373`.
+> Per-platform SBOM and provenance evidence and both registry signatures passed
+> verification.
 
 - Based on [official image](https://hub.docker.com/_/wordpress), Easier and more sustainable solution.
 - DockerHub Page: https://hub.docker.com/r/soulteary/sqlite-wordpress
@@ -61,14 +57,8 @@ docker exec -it <container> ls -l /var/www/html/wp-content/mu-plugins/
 
 ## Quick Start
 
-Until `2026.10.12-r1` is published, build current `main` locally:
-
-```bash
-docker build -t sqlite-wordpress:main .
-```
-
-After the protected release workflow succeeds, pull the rolling tag for
-convenience or the immutable CalVer release for reproducible deployments:
+Pull the rolling tag for convenience or the immutable CalVer release for
+reproducible deployments:
 
 ```bash
 # Docker Hub: use latest
@@ -81,12 +71,12 @@ docker pull ghcr.io/soulteary/sqlite-wordpress:latest
 docker pull ghcr.io/soulteary/sqlite-wordpress:2026.10.12-r1
 ```
 
-Launch the locally built image on port `8080`:
+Launch the published image on port `8080`:
 
 ```bash
 docker run --rm -it -p 127.0.0.1:8080:80 \
   -v "$(pwd)/wordpress:/var/www/html" \
-  sqlite-wordpress:main
+  soulteary/sqlite-wordpress:2026.10.12-r1
 ```
 
 You can also use docker compose to start wordpress:
@@ -95,9 +85,7 @@ You can also use docker compose to start wordpress:
 services:
 
   wordpress:
-    build:
-      context: .
-    image: sqlite-wordpress:main
+    image: soulteary/sqlite-wordpress:2026.10.12-r1
     restart: always
     ports:
       # Safe local default. Change this only when intentionally publishing the
@@ -107,7 +95,7 @@ services:
       - ./wordpress:/var/www/html
 ```
 
-Save the file as `docker-compose.yml` and execute `docker compose up --build`,
+Save the file as `docker-compose.yml` and execute `docker compose up -d`,
 then use a browser to access `localhost:8080`.
 
 ![](.github/ready-to-use.jpg)
@@ -236,7 +224,7 @@ OwlMail listener publicly.
 
 ## Image Versions and Supply-chain Evidence
 
-Image releases use CalVer such as `2026.09.02-r2`; WordPress and SQLite
+Image releases use CalVer such as `2026.10.12-r1`; WordPress and SQLite
 Integration keep their own component versions. Exact `YYYY.MM.DD-rN` tags are
 immutable, while the date-only tag and `latest` are verified mutable aliases.
 Pin an exact tag or manifest digest in production. See
@@ -342,7 +330,7 @@ chmod 600 secrets/site-url-update-token
 services:
 
   wordpress:
-    image: soulteary/sqlite-wordpress:2026.09.02-r2
+    image: soulteary/sqlite-wordpress:2026.10.12-r1
     ports:
       - 127.0.0.1:8080:80
     environment:
@@ -372,7 +360,7 @@ export WORDPRESS_SITE_URL_UPDATE_PASSWORD="$(openssl rand -base64 24)"
 services:
 
   wordpress:
-    image: soulteary/sqlite-wordpress:2026.09.02-r2
+    image: soulteary/sqlite-wordpress:2026.10.12-r1
     ports:
       - 127.0.0.1:8080:80
     environment:
@@ -400,7 +388,7 @@ docker run --rm -it \
   --volume "$(pwd)/secrets/site-url-update-token:/run/secrets/site-url-update-token:ro" \
   --env WORDPRESS_SITE_URL_UPDATE_TOOL_ENABLED=true \
   --env WORDPRESS_SITE_URL_UPDATE_TOKEN_FILE=/run/secrets/site-url-update-token \
-  soulteary/sqlite-wordpress:2026.09.02-r2
+  soulteary/sqlite-wordpress:2026.10.12-r1
 ```
 
 For PASSWORD, export a fresh value and pass only the variable name so the shell
@@ -414,7 +402,7 @@ docker run --rm -it \
   --volume "$(pwd)/wordpress:/var/www/html" \
   --env WORDPRESS_SITE_URL_UPDATE_TOOL_ENABLED=true \
   --env WORDPRESS_SITE_URL_UPDATE_PASSWORD \
-  soulteary/sqlite-wordpress:2026.09.02-r2
+  soulteary/sqlite-wordpress:2026.10.12-r1
 ```
 
 After the update, stop this temporary container and start the normal deployment
@@ -616,7 +604,7 @@ docker run --rm --user 0:0 \
   --mount type=bind,source="$(pwd)/wordpress",target=/source,readonly \
   --mount type=bind,source="$(pwd)/backups",target=/backup \
   --env "BACKUP_NAME=${backup_name}" \
-  soulteary/sqlite-wordpress:2026.09.02-r2 \
+  soulteary/sqlite-wordpress:2026.10.12-r1 \
   -Eeuo pipefail -c '
     [[ -n "${BACKUP_NAME}" && "${BACKUP_NAME}" != */* ]]
     archive="/backup/${BACKUP_NAME}"
@@ -651,7 +639,7 @@ docker run --rm --user 0:0 \
   --mount "type=volume,source=${wordpress_volume},target=/source,readonly" \
   --mount type=bind,source="$(pwd)/backups",target=/backup \
   --env "BACKUP_NAME=${backup_name}" \
-  soulteary/sqlite-wordpress:2026.09.02-r2 \
+  soulteary/sqlite-wordpress:2026.10.12-r1 \
   -Eeuo pipefail -c '
     [[ -n "${BACKUP_NAME}" && "${BACKUP_NAME}" != */* ]]
     archive="/backup/${BACKUP_NAME}"
@@ -684,7 +672,7 @@ docker run --rm --user 0:0 \
   --mount type=bind,source="$(pwd)/wordpress",target=/source \
   --mount type=bind,source="$(pwd)/backups",target=/backup,readonly \
   --env "BACKUP_NAME=${backup_name}" \
-  soulteary/sqlite-wordpress:2026.09.02-r2 \
+  soulteary/sqlite-wordpress:2026.10.12-r1 \
   -Eeuo pipefail -c '
     [[ -n "${BACKUP_NAME}" && "${BACKUP_NAME}" != */* ]]
     archive="/backup/${BACKUP_NAME}"
@@ -722,7 +710,7 @@ docker run --rm --user 0:0 \
   --mount "type=volume,source=${wordpress_volume},target=/source" \
   --mount type=bind,source="$(pwd)/backups",target=/backup,readonly \
   --env "BACKUP_NAME=${backup_name}" \
-  soulteary/sqlite-wordpress:2026.09.02-r2 \
+  soulteary/sqlite-wordpress:2026.10.12-r1 \
   -Eeuo pipefail -c '
     [[ -n "${BACKUP_NAME}" && "${BACKUP_NAME}" != */* ]]
     archive="/backup/${BACKUP_NAME}"

docker-compose.yml

@@ -1,9 +1,7 @@
 services:
 
   wordpress:
-    build:
-      context: .
-    image: sqlite-wordpress:main
+    image: soulteary/sqlite-wordpress:2026.10.12-r1
     restart: always
     ports:
       # Safe local default. Replace 127.0.0.1 only when intentionally publishing