v0.2.2 — verified community multiarchitecture images

Community Docker Compose deployment with mandatory fresh Bitwarden/Vaultwarden credentials at every execution.

• Pull a versioned GHCR image for amd64 or arm64; local builds and host Python are contributor workflows.
• Configure a dedicated vault account, API credentials, master password and exact Login item UUID. Direct DEGIRO credential environment variables are rejected.
• Follow the root README for Ghostfolio authentication, discovery, mapping, persistent state permissions, DRY_RUN review and scheduling.
• Failed scheduled runs, including DRY_RUN, alert through optional Apprise; successful runs remain silent.
• Upstream release/source watches open review issues without changing versions or deploying.
• Remove personal deployment material and fix the CodeQL logging regression without weakening privacy coverage.

Breaking configuration change: migrate to the documented BW_* variables before upgrading. Keep DRY_RUN=1 until the proposal is reviewed. Preserve mapping and state volumes; record the previous image digest and restore that digest for rollback. No production deployment or financial mutation is included in this release.

Validation: 1,475 offline tests and native amd64/arm64 container CI passed. PR #48 and PR #49 passed guarded merges with completed exact-head CodeRabbit coverage; final PR #49 head is 9d7b532. PR #45 was merged separately by the maintainer with an explicit CodeRabbit override. The release workflow gates image publication with security scans, native smoke checks, a synthetic community journey, SBOM and provenance. Registry publication and anonymous community acceptance are complete: workflow https://github.com/flowcool/ghostfolio-degiro-sync/actions/runs/38146725561 succeeded on both native architectures.

Packaging correction: authenticate before the package exists, publish checked images by digest, then strictly verify version-tag absence before publishing the multiarchitecture manifest. First v0.2.0 image publication failed before any images were published; its source tag remains immutable. Failure diagnostics reveal only the phase and HTTP status.

Verify the actual native config inside published attested OCI indexes against the scanned/tested local image before assembling the version manifest. The prior v0.2.1 version manifest was never published because its post-push metadata check failed; source tags remain immutable.

Published image: ghcr.io/flowcool/ghostfolio-degiro-sync:v0.2.2 (linux/amd64 and linux/arm64).
Immutable digest: sha256:fc7b8fa858cc9878e8ac970c06a42d0d19e57c6f648e8e56b5284fc208720752; stable latest resolves to this same digest. Both architectures include SBOM and build provenance attestations.

Anonymous pull and the complete community Compose journey passed from a clean checkout of v0.2.2 using isolated synthetic vault/broker/destination/notification responses and network-disabled runtime containers. Scheduled DRY_RUN failure delivered one alert through the real Apprise library with mocked HTTP, success stayed silent. An actual image change and restore by captured digest preserved mapping, state and journal hashes. Public manifest and verification evidence are attached to this release. No production deployment or financial mutation was performed.