Stale branches with unmerged improvements: `devops/fix_copy_with_semicolon` and `devops/update-new-line-separator`

[chirojr]

Description

Two branches have been sitting unmerged on the origin remote, each containing meaningful improvements to the codebase:

devops/fix_copy_with_semicolon

Contains a fix for semicolon-prefixed copy paths in the Dockerfile generator, but also removes:

• check-ssh.sh (SSH signature verification script)
• generate-ssh-allowed-signers.sh
• env_copy feature from the Dockerfile template
• COREPACK_ENABLE feature
• Nginx RUNNER_COMMANDS for cache dirs/pid

devops/update-new-line-separator

• Removes COREPACK_ENABLE
• Updates ssh-allowed-signers with keys for all current team members (alothanhh, BaoNinh2808, brianw3b, CaoHoaiTan, harris1111, hungnguyen18, ngotrongphuc, nguyendinhthang3101, SangTran-127, ThanhNguyen03)
• Adds new documentation files (README-2.md, docs/dockerfile-generator.md)

Concerns

1. Check-ssh.sh removal — The fix_copy_with_semicolon branch deletes check-ssh.sh entirely. Is SSH signature verification being deprecated, or was this accidental?

2. Nginx RUNNER_COMMANDS removal — The nginx-specific RUNNER_COMMANDS (cache dir setup, pid relocation, user directive removal) are removed in fix_copy_with_semicolon. These are needed for running nginx as non-root. Was this intentional?

3. Stale SSH allowed-signers — The SSH allowed-signers file in main only lists 4 users (brng1151, chiro-hiro, bao-ninh-orochi, chirojr) while the team has grown significantly. The update-new-line-separator branch has the updated version.

Suggested Action

Rebase, reconcile the differences, and merge — or close, with clear rationale for any deletions.

[chirojr]

Triage: Maintenance

This is a repository hygiene task (stale branch cleanup). Labeling as maintenance.

[chiro-hiro]

Closing — both branches are stale and unsafe to merge, and have now been deleted from origin (and the fork mirror).

devops/fix_copy_with_semicolon

Its headline fix — prepend BUILDER_WORKDIR for relative semicolon paths — is already in main (dockerfile.sh, generate_copy_instructions), integrated via the security-hardening work. The branch was 1 commit ahead / far behind main and also carried destructive deletions (check-ssh.sh, generate-ssh-allowed-signers.sh, ssh-allowed-signers, .gitignore, CHANGELOG.md, CODEOWNERS, SECURITY.md), so it could not be merged as-is.

devops/update-new-line-separator

Built on an obsolete snapshot predating the security hardening on main. Merging would have regressed the runner: it lacked set -euo pipefail, template validation, and the BuildKit-secret credential handling that keeps the npm token out of builder layers, and it carried the same destructive deletions. Its newline-separator approach was also superseded — main adopted the src;dst semicolon format.

Follow-up (not a blocker)

The only genuinely useful unmerged content was the expanded ssh-allowed-signers (more team members). That is a trust-root change and should be added via a fresh, verified PR against current main with each contributor's actual signing key — not by resurrecting these branches. Same goes for any wanted docs (docs/dockerfile-generator.md).

The two original bug items referenced here are handled separately: #44 → PR #53, the redis pin → PR #54, and the shell-quoting item → #43 (already fixed).