[chen21019]

Result

Keep both exact-version release checks while avoiding an early-closing stdout pipe. No scan, attestation, source/image build, or publication gate is removed or relaxed. The signed v0.9.28 and v0.9.29 tags remain immutable; this source candidate targets new v0.9.30.

Evidence and narrow fix

The v0.9.29 Release run installed all pinned APK packages, verified and compiled HAProxy 3.4.3, and built the image successfully. The version-smoke section then failed with write /dev/stdout: broken pipe. The log does not establish which of the two Docker commands encountered the early close, so neither is claimed as uniquely proven.

Both existing checks pipe Docker stdout through grep -Fq under set -euo pipefail. A deterministic multi-write producer reproduces the oracle defect: the matching grep exits successfully while the still-writing producer exits 141. Capture each Docker command's complete stdout first, then run full-reading grep -F on the captured text. Assignment failures still terminate the step through the existing set -e.

The adjacent scripts/package has no analogous version-output pipe; it is unchanged. README truthfully records the retained failed tags and native QA pending.

Validation

Tested the four actual changed workflow lines extracted into Bash, with deterministic multi-write Docker fixtures:

• Correct controller and HAProxy version output: exit 0.
• Controller command emits matching output but fails: exit 42 is preserved.
• HAProxy command emits matching output but fails: exit 43 is preserved.
• Wrong controller version: exit 1.
• Wrong HAProxy version: exit 1.
• bash -n of the actual smoke section and git diff --check: PASS.

No unrelated test suite was rerun locally. Native PastureStack load-balancer QA remains pending. No QA/production runtime or other repository was modified.