From d23c339ea798c4b97d88fee749869a562fd213cb Mon Sep 17 00:00:00 2001
From: "Benjamin R. J. Schwedler" <ben@posit.co>
Date: Wed, 27 May 2026 08:06:32 -0500
Subject: [PATCH 1/4] Add ARM platform to Workbench 2026.05.0

---
 bakery.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bakery.yaml b/bakery.yaml
index a5d536f..6376613 100644
--- a/bakery.yaml
+++ b/bakery.yaml
@@ -76,6 +76,9 @@ images:
           - name: Ubuntu 22.04
           - name: Ubuntu 24.04
             primary: true
+            platforms:
+              - linux/amd64
+              - linux/arm64
         dependencies:
           - dependency: R
             version: 4.6.0
@@ -140,6 +143,9 @@ images:
         os:
           - name: Ubuntu 24.04
             primary: true
+            platforms:
+              - linux/amd64
+              - linux/arm64
       - name: 2026.04.0+526.pro2
         subpath: '2026.04'
         os:

From 2acc8bea6e1996d0bdb9cc6bc1a7e9ba309dc7a9 Mon Sep 17 00:00:00 2001
From: "Benjamin R. J. Schwedler" <ben@posit.co>
Date: Tue, 9 Jun 2026 09:18:17 -0500
Subject: [PATCH 2/4] Re-render templates to fix ARM session-init tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The session-init goss.yaml renders were stale and missing the
IMAGE_OS_PLATFORM guard for opensuse15 and rhel8. Those directories are
only present in the amd64 build of the upstream rsp-session-multi-linux
tarball, so the tests must be skipped on arm64. The quarto check remains
unconditional — ARM builds include it.

Also picks up other pending template changes not yet rendered:
- TinyTeX comment block added to workbench Containerfiles
- Blank-line whitespace normalization in workbench Containerfiles
- positron-init matrix: remove redundant apt retry config from final stage
---
 .../matrix/Containerfile.ubuntu2404           |  3 +--
 workbench-session-init/2025.09/test/goss.yaml | 20 +++++++++++++------
 workbench-session-init/2026.01/test/goss.yaml | 20 +++++++++++++------
 workbench-session-init/2026.04/test/goss.yaml | 20 +++++++++++++------
 workbench-session-init/2026.05/test/goss.yaml | 20 +++++++++++++------
 .../2025.09/Containerfile.ubuntu2204.min      |  1 +
 .../2025.09/Containerfile.ubuntu2204.std      |  1 +
 .../2025.09/Containerfile.ubuntu2404.min      |  1 +
 .../2025.09/Containerfile.ubuntu2404.std      |  1 +
 .../2026.01/Containerfile.ubuntu2204.min      |  1 +
 .../2026.01/Containerfile.ubuntu2204.std      |  1 +
 .../2026.01/Containerfile.ubuntu2404.min      |  1 +
 .../2026.01/Containerfile.ubuntu2404.std      |  1 +
 .../2026.04/Containerfile.ubuntu2204.min      |  1 +
 .../2026.04/Containerfile.ubuntu2204.std      |  7 +++++++
 .../2026.04/Containerfile.ubuntu2404.min      |  1 +
 .../2026.04/Containerfile.ubuntu2404.std      |  7 +++++++
 .../2026.05/Containerfile.ubuntu2204.min      |  1 +
 .../2026.05/Containerfile.ubuntu2204.std      |  1 +
 .../2026.05/Containerfile.ubuntu2404.min      |  1 +
 .../2026.05/Containerfile.ubuntu2404.std      |  1 +
 21 files changed, 85 insertions(+), 26 deletions(-)

diff --git a/workbench-positron-init/matrix/Containerfile.ubuntu2404 b/workbench-positron-init/matrix/Containerfile.ubuntu2404
index 45c6a68..1428ddd 100644
--- a/workbench-positron-init/matrix/Containerfile.ubuntu2404
+++ b/workbench-positron-init/matrix/Containerfile.ubuntu2404
@@ -64,8 +64,7 @@ LABEL org.opencontainers.image.base.name="docker.io/library/ubuntu:24.04"
 
 ARG DEBIAN_FRONTEND=noninteractive
 
-RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
-    apt-get update -yqq --fix-missing && \
+RUN apt-get update -yqq --fix-missing && \
     apt-get upgrade -yqq && \
     apt-get dist-upgrade -yqq && \
     apt-get autoremove -yqq --purge && \
diff --git a/workbench-session-init/2025.09/test/goss.yaml b/workbench-session-init/2025.09/test/goss.yaml
index 12541cd..bbf5bfc 100644
--- a/workbench-session-init/2025.09/test/goss.yaml
+++ b/workbench-session-init/2025.09/test/goss.yaml
@@ -19,10 +19,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/opensuse15:
-    exists: true
-    filetype: directory
-    mode: "0755"
   /opt/session-components/bin/postback:
     exists: true
     filetype: directory
@@ -39,14 +35,26 @@ file:
     exists: true
     filetype: file
     mode: "0755"
-  /opt/session-components/bin/rhel8:
+  /opt/session-components/bin/rhel9:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/rhel9:
+  /opt/session-components/bin/rhel10:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  # opensuse15 and rhel8 are only shipped in the amd64 build of the
+  # upstream rsp-session-multi-linux tarball.
+  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
+  /opt/session-components/bin/opensuse15:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  /opt/session-components/bin/rhel8:
     exists: true
     filetype: directory
     mode: "0755"
+  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file
diff --git a/workbench-session-init/2026.01/test/goss.yaml b/workbench-session-init/2026.01/test/goss.yaml
index 12541cd..bbf5bfc 100644
--- a/workbench-session-init/2026.01/test/goss.yaml
+++ b/workbench-session-init/2026.01/test/goss.yaml
@@ -19,10 +19,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/opensuse15:
-    exists: true
-    filetype: directory
-    mode: "0755"
   /opt/session-components/bin/postback:
     exists: true
     filetype: directory
@@ -39,14 +35,26 @@ file:
     exists: true
     filetype: file
     mode: "0755"
-  /opt/session-components/bin/rhel8:
+  /opt/session-components/bin/rhel9:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/rhel9:
+  /opt/session-components/bin/rhel10:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  # opensuse15 and rhel8 are only shipped in the amd64 build of the
+  # upstream rsp-session-multi-linux tarball.
+  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
+  /opt/session-components/bin/opensuse15:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  /opt/session-components/bin/rhel8:
     exists: true
     filetype: directory
     mode: "0755"
+  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file
diff --git a/workbench-session-init/2026.04/test/goss.yaml b/workbench-session-init/2026.04/test/goss.yaml
index 12541cd..bbf5bfc 100644
--- a/workbench-session-init/2026.04/test/goss.yaml
+++ b/workbench-session-init/2026.04/test/goss.yaml
@@ -19,10 +19,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/opensuse15:
-    exists: true
-    filetype: directory
-    mode: "0755"
   /opt/session-components/bin/postback:
     exists: true
     filetype: directory
@@ -39,14 +35,26 @@ file:
     exists: true
     filetype: file
     mode: "0755"
-  /opt/session-components/bin/rhel8:
+  /opt/session-components/bin/rhel9:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/rhel9:
+  /opt/session-components/bin/rhel10:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  # opensuse15 and rhel8 are only shipped in the amd64 build of the
+  # upstream rsp-session-multi-linux tarball.
+  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
+  /opt/session-components/bin/opensuse15:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  /opt/session-components/bin/rhel8:
     exists: true
     filetype: directory
     mode: "0755"
+  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file
diff --git a/workbench-session-init/2026.05/test/goss.yaml b/workbench-session-init/2026.05/test/goss.yaml
index 12541cd..bbf5bfc 100644
--- a/workbench-session-init/2026.05/test/goss.yaml
+++ b/workbench-session-init/2026.05/test/goss.yaml
@@ -19,10 +19,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/opensuse15:
-    exists: true
-    filetype: directory
-    mode: "0755"
   /opt/session-components/bin/postback:
     exists: true
     filetype: directory
@@ -39,14 +35,26 @@ file:
     exists: true
     filetype: file
     mode: "0755"
-  /opt/session-components/bin/rhel8:
+  /opt/session-components/bin/rhel9:
     exists: true
     filetype: directory
     mode: "0755"
-  /opt/session-components/bin/rhel9:
+  /opt/session-components/bin/rhel10:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  # opensuse15 and rhel8 are only shipped in the amd64 build of the
+  # upstream rsp-session-multi-linux tarball.
+  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
+  /opt/session-components/bin/opensuse15:
+    exists: true
+    filetype: directory
+    mode: "0755"
+  /opt/session-components/bin/rhel8:
     exists: true
     filetype: directory
     mode: "0755"
+  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file
diff --git a/workbench/2025.09/Containerfile.ubuntu2204.min b/workbench/2025.09/Containerfile.ubuntu2204.min
index 18eb41c..88c2f81 100644
--- a/workbench/2025.09/Containerfile.ubuntu2204.min
+++ b/workbench/2025.09/Containerfile.ubuntu2204.min
@@ -20,6 +20,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2025.09/Containerfile.ubuntu2204.std b/workbench/2025.09/Containerfile.ubuntu2204.std
index 4d6d407..1928645 100644
--- a/workbench/2025.09/Containerfile.ubuntu2204.std
+++ b/workbench/2025.09/Containerfile.ubuntu2204.std
@@ -30,6 +30,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2025.09/Containerfile.ubuntu2404.min b/workbench/2025.09/Containerfile.ubuntu2404.min
index 71b1ec1..8b0b464 100644
--- a/workbench/2025.09/Containerfile.ubuntu2404.min
+++ b/workbench/2025.09/Containerfile.ubuntu2404.min
@@ -22,6 +22,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
diff --git a/workbench/2025.09/Containerfile.ubuntu2404.std b/workbench/2025.09/Containerfile.ubuntu2404.std
index 72c67ce..c357a7f 100644
--- a/workbench/2025.09/Containerfile.ubuntu2404.std
+++ b/workbench/2025.09/Containerfile.ubuntu2404.std
@@ -32,6 +32,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
diff --git a/workbench/2026.01/Containerfile.ubuntu2204.min b/workbench/2026.01/Containerfile.ubuntu2204.min
index de05cab..b984ca0 100644
--- a/workbench/2026.01/Containerfile.ubuntu2204.min
+++ b/workbench/2026.01/Containerfile.ubuntu2204.min
@@ -20,6 +20,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2026.01/Containerfile.ubuntu2204.std b/workbench/2026.01/Containerfile.ubuntu2204.std
index 13615b1..df76223 100644
--- a/workbench/2026.01/Containerfile.ubuntu2204.std
+++ b/workbench/2026.01/Containerfile.ubuntu2204.std
@@ -30,6 +30,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2026.01/Containerfile.ubuntu2404.min b/workbench/2026.01/Containerfile.ubuntu2404.min
index 4167990..50bb627 100644
--- a/workbench/2026.01/Containerfile.ubuntu2404.min
+++ b/workbench/2026.01/Containerfile.ubuntu2404.min
@@ -22,6 +22,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
diff --git a/workbench/2026.01/Containerfile.ubuntu2404.std b/workbench/2026.01/Containerfile.ubuntu2404.std
index cbcc08d..c0192cb 100644
--- a/workbench/2026.01/Containerfile.ubuntu2404.std
+++ b/workbench/2026.01/Containerfile.ubuntu2404.std
@@ -32,6 +32,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
diff --git a/workbench/2026.04/Containerfile.ubuntu2204.min b/workbench/2026.04/Containerfile.ubuntu2204.min
index 27cd636..e53f1d2 100644
--- a/workbench/2026.04/Containerfile.ubuntu2204.min
+++ b/workbench/2026.04/Containerfile.ubuntu2204.min
@@ -20,6 +20,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2026.04/Containerfile.ubuntu2204.std b/workbench/2026.04/Containerfile.ubuntu2204.std
index 51a75d1..47b2ee5 100644
--- a/workbench/2026.04/Containerfile.ubuntu2204.std
+++ b/workbench/2026.04/Containerfile.ubuntu2204.std
@@ -30,6 +30,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
@@ -122,6 +123,12 @@ RUN mkdir -p /var/lib/rstudio-server/monitor/log \
 ### Install TinyTeX using Quarto ###
 # Caches won't invalidate correctly on new releases for TinyTeX installs. This ADD instruction is a workaround to bust
 # the cache on new releases.
+#
+# TinyTeX is installed under HOME="/opt" so the install lands at /opt/.TinyTeX,
+# which is readable by non-root runtime users. `--update-path` makes tlmgr
+# symlink the TinyTeX binaries into /usr/local/bin.
+# TODO: Remove `HOME="/opt"` once Quarto supports custom install locations
+# for TinyTeX, see https://github.com/quarto-dev/quarto-cli/issues/11800.
 ADD https://github.com/rstudio/tinytex-releases/releases/latest /tmp/tinytex-release.json
 RUN --mount=type=secret,id=github_token,required=false \
     GH_TOKEN="$([ -s /run/secrets/github_token ] && cat /run/secrets/github_token)" HOME="/opt" /lib/rstudio-server/bin/quarto/bin/quarto install tinytex --no-prompt --update-path \
diff --git a/workbench/2026.04/Containerfile.ubuntu2404.min b/workbench/2026.04/Containerfile.ubuntu2404.min
index 366d887..9b2e740 100644
--- a/workbench/2026.04/Containerfile.ubuntu2404.min
+++ b/workbench/2026.04/Containerfile.ubuntu2404.min
@@ -22,6 +22,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
diff --git a/workbench/2026.04/Containerfile.ubuntu2404.std b/workbench/2026.04/Containerfile.ubuntu2404.std
index e31f04a..5986097 100644
--- a/workbench/2026.04/Containerfile.ubuntu2404.std
+++ b/workbench/2026.04/Containerfile.ubuntu2404.std
@@ -32,6 +32,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
@@ -122,6 +123,12 @@ RUN mkdir -p /var/lib/rstudio-server/monitor/log \
 ### Install TinyTeX using Quarto ###
 # Caches won't invalidate correctly on new releases for TinyTeX installs. This ADD instruction is a workaround to bust
 # the cache on new releases.
+#
+# TinyTeX is installed under HOME="/opt" so the install lands at /opt/.TinyTeX,
+# which is readable by non-root runtime users. `--update-path` makes tlmgr
+# symlink the TinyTeX binaries into /usr/local/bin.
+# TODO: Remove `HOME="/opt"` once Quarto supports custom install locations
+# for TinyTeX, see https://github.com/quarto-dev/quarto-cli/issues/11800.
 ADD https://github.com/rstudio/tinytex-releases/releases/latest /tmp/tinytex-release.json
 RUN --mount=type=secret,id=github_token,required=false \
     GH_TOKEN="$([ -s /run/secrets/github_token ] && cat /run/secrets/github_token)" HOME="/opt" /lib/rstudio-server/bin/quarto/bin/quarto install tinytex --no-prompt --update-path \
diff --git a/workbench/2026.05/Containerfile.ubuntu2204.min b/workbench/2026.05/Containerfile.ubuntu2204.min
index d26d06c..3140468 100644
--- a/workbench/2026.05/Containerfile.ubuntu2204.min
+++ b/workbench/2026.05/Containerfile.ubuntu2204.min
@@ -20,6 +20,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2026.05/Containerfile.ubuntu2204.std b/workbench/2026.05/Containerfile.ubuntu2204.std
index c3e74f4..fe976fd 100644
--- a/workbench/2026.05/Containerfile.ubuntu2204.std
+++ b/workbench/2026.05/Containerfile.ubuntu2204.std
@@ -30,6 +30,7 @@ ENV PWB_DIAGNOSTIC_DIR=/var/log/rstudio
 ENV PWB_DIAGNOSTIC_ENABLE=false
 ENV PWB_EXIT_AFTER_VERIFY=false
 
+
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
 ### Setup environment ###
diff --git a/workbench/2026.05/Containerfile.ubuntu2404.min b/workbench/2026.05/Containerfile.ubuntu2404.min
index ba806bf..2ab05ac 100644
--- a/workbench/2026.05/Containerfile.ubuntu2404.min
+++ b/workbench/2026.05/Containerfile.ubuntu2404.min
@@ -22,6 +22,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \
diff --git a/workbench/2026.05/Containerfile.ubuntu2404.std b/workbench/2026.05/Containerfile.ubuntu2404.std
index a465844..f97e5a2 100644
--- a/workbench/2026.05/Containerfile.ubuntu2404.std
+++ b/workbench/2026.05/Containerfile.ubuntu2404.std
@@ -32,6 +32,7 @@ ENV PWB_EXIT_AFTER_VERIFY=false
 
 SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
 
+
 ### Setup environment ###
 RUN echo 'Acquire::Retries "3"; Acquire::http::Timeout "30"; Acquire::https::Timeout "30";' > /etc/apt/apt.conf.d/99-retries && \
     apt-get update -yqq --fix-missing && \

From 0c1e022047cb9b984c946c2d667f70b384f85e2d Mon Sep 17 00:00:00 2001
From: "Benjamin R. J. Schwedler" <ben@posit.co>
Date: Tue, 9 Jun 2026 09:34:15 -0500
Subject: [PATCH 3/4] Scope ARM goss conditional to 2026.05 only

Only 2026.05.0 ships ARM builds; the earlier version directories
(2025.09, 2026.01, 2026.04) are amd64-only, so opensuse15 and rhel8
should remain unconditional there.
---
 workbench-session-init/2025.09/test/goss.yaml | 4 ----
 workbench-session-init/2026.01/test/goss.yaml | 4 ----
 workbench-session-init/2026.04/test/goss.yaml | 4 ----
 3 files changed, 12 deletions(-)

diff --git a/workbench-session-init/2025.09/test/goss.yaml b/workbench-session-init/2025.09/test/goss.yaml
index bbf5bfc..22242dd 100644
--- a/workbench-session-init/2025.09/test/goss.yaml
+++ b/workbench-session-init/2025.09/test/goss.yaml
@@ -43,9 +43,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  # opensuse15 and rhel8 are only shipped in the amd64 build of the
-  # upstream rsp-session-multi-linux tarball.
-  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
   /opt/session-components/bin/opensuse15:
     exists: true
     filetype: directory
@@ -54,7 +51,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file
diff --git a/workbench-session-init/2026.01/test/goss.yaml b/workbench-session-init/2026.01/test/goss.yaml
index bbf5bfc..22242dd 100644
--- a/workbench-session-init/2026.01/test/goss.yaml
+++ b/workbench-session-init/2026.01/test/goss.yaml
@@ -43,9 +43,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  # opensuse15 and rhel8 are only shipped in the amd64 build of the
-  # upstream rsp-session-multi-linux tarball.
-  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
   /opt/session-components/bin/opensuse15:
     exists: true
     filetype: directory
@@ -54,7 +51,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file
diff --git a/workbench-session-init/2026.04/test/goss.yaml b/workbench-session-init/2026.04/test/goss.yaml
index bbf5bfc..22242dd 100644
--- a/workbench-session-init/2026.04/test/goss.yaml
+++ b/workbench-session-init/2026.04/test/goss.yaml
@@ -43,9 +43,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  # opensuse15 and rhel8 are only shipped in the amd64 build of the
-  # upstream rsp-session-multi-linux tarball.
-  {{- if eq .Env.IMAGE_OS_PLATFORM "linux/amd64" }}
   /opt/session-components/bin/opensuse15:
     exists: true
     filetype: directory
@@ -54,7 +51,6 @@ file:
     exists: true
     filetype: directory
     mode: "0755"
-  {{- end }}
   /opt/session-components/bin/shared-run:
     exists: true
     filetype: file

From cbbfe416daff4de6ed9c4b68f94a85ae3745b0bc Mon Sep 17 00:00:00 2001
From: "Benjamin R. J. Schwedler" <ben@posit.co>
Date: Tue, 9 Jun 2026 16:37:19 -0500
Subject: [PATCH 4/4] Switch release workflow to GitHub App client ID

The actions/create-github-app-token action recommends client-id over
the legacy app-id input. All three credential secrets (APP_ID,
CLIENT_ID, PEM) are already provisioned; this switches to CLIENT_ID.

Also adds a monthly deprecate-editions workflow that removes product
editions older than 18 months, updates the workbench-positron-init
min constraint to match the 18-month cutoff, and creates a PR.
---
 .github/workflows/deprecate.yml | 19 +++++++++++++++++++
 .github/workflows/release.yml   |  4 ++--
 2 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/deprecate.yml

diff --git a/.github/workflows/deprecate.yml b/.github/workflows/deprecate.yml
new file mode 100644
index 0000000..e8bbcba
--- /dev/null
+++ b/.github/workflows/deprecate.yml
@@ -0,0 +1,19 @@
+name: Deprecate Editions
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch: {}
+
+jobs:
+  deprecate:
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: posit-dev/images-shared/.github/workflows/deprecate-editions.yml@main
+    with:
+      images: "workbench workbench-session-init"
+      update-positron-min: true
+    secrets:
+      CLIENT_ID: ${{ secrets.WORKBENCH_IDE_RELEASE_CLIENT_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.WORKBENCH_IDE_RELEASE_PEM }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b245e2..d6efef2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
       version: ${{ inputs.version }}
       images: "workbench workbench-session-init"
     secrets:
-      APP_ID: ${{ secrets.WORKBENCH_IDE_RELEASE_APP_ID }}
+      CLIENT_ID: ${{ secrets.WORKBENCH_IDE_RELEASE_CLIENT_ID }}
       APP_PRIVATE_KEY: ${{ secrets.WORKBENCH_IDE_RELEASE_PEM }}
 
   trigger-specialized:
@@ -31,7 +31,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
         with:
-          app-id: ${{ secrets.WORKBENCH_IDE_RELEASE_APP_ID }}
+          client-id: ${{ secrets.WORKBENCH_IDE_RELEASE_CLIENT_ID }}
           private-key: ${{ secrets.WORKBENCH_IDE_RELEASE_PEM }}
           owner: posit-dev
           repositories: images-specialized