diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..9a9ea67
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: build
+
+# Build check: GoReleaser snapshot build of everything, publishing nothing,
+# then package validation. The `build` job is the required status check.
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  goreleaser:
+    uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+
+  validate:
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      packages: |
+        - name: testbed-quadlet*
+          files:
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+          rpm-files:
+            - /usr/share/licenses/testbed-quadlet/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed-quadlet/copyright
+        # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet.
+        - name: testbed[-_][0-9]*
+          files:
+            - /usr/bin/testbed
+          rpm-files:
+            - /usr/share/licenses/testbed/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed/copyright
+
+  build:
+    if: ${{ always() }}
+    needs: [goreleaser, validate]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
new file mode 100644
index 0000000..064b881
--- /dev/null
+++ b/.github/workflows/cleanup.yml
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: cleanup
+
+# Deletes the pr-<N> images named in .goreleaser.yaml (testbed and
+# testbed-alt) when a PR closes.
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read   # checkout, to read .goreleaser.yaml
+  packages: write  # delete image versions
+
+jobs:
+  cleanup:
+    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@7af41e39e2270b711bd18385f1586df9f7bf98de # github-actions under test (seantronsen/feat/decouple-pr-cleanup)
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..0518ec6
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: dependency-review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read        # baseline for checkout
+      pull-requests: write  # summary comment on the PR
+
+  dependency-review:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
new file mode 100644
index 0000000..f113905
--- /dev/null
+++ b/.github/workflows/govulncheck.yml
@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: govulncheck
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  govulncheck:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..3d5097f
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: lint
+
+# All linters under one gate: the `lint` job is the required status check.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  lint-go:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+
+  lint-ci:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # zizmor SARIF upload to GHAS
+
+  lint-renovate:
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-renovate.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  lint:
+    if: ${{ always() }}
+    needs: [lint-go, lint-ci, lint-renovate]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..eca9fbd
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,94 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: release
+
+# PR images and releases; build-release-goreleaser picks the mode from the
+# event:
+# - pull_request: pushes ghcr.io/openchami/github-actions-testbed:pr-<N>.
+# - v* tag push: semver images, signed packages, draft release, validation,
+#   then publish. Safe to tag freely: nothing depends on this repo.
+
+on:
+  pull_request:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: read
+
+jobs:
+  # Throwaway signing key, regenerated each run. Not a secret (it travels as
+  # a job output); fine here, since the packages are only for testing.
+  test-key:
+    runs-on: ubuntu-slim
+    outputs:
+      gpg-key-b64: ${{ steps.key.outputs.gpg-key-b64 }}
+    steps:
+      - name: Generate throwaway GPG key
+        id: key
+        run: |
+          set -euo pipefail
+          GNUPGHOME=$(mktemp -d)
+          export GNUPGHOME
+          gpg --batch --quiet --passphrase '' \
+            --quick-gen-key 'github-actions testbed throwaway key <noreply@openchami.org>' rsa3072 sign 1d
+          echo "gpg-key-b64=$(gpg --batch --armor --export-secret-keys | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  goreleaser:
+    needs: test-key
+    permissions:
+      contents: write      # release creation, uploading assets
+      packages: write      # image push, container provenance
+      id-token: write      # Sigstore signing (attest-build-provenance)
+      attestations: write  # build provenance attestations
+    uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      go-version-file: go.mod
+    secrets:
+      gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }}
+
+  trivy:
+    # Scans the images named in .goreleaser.yaml (testbed and testbed-alt) at
+    # this run's tag (pr-<N> on PRs); fork PRs push nothing, so nothing matches.
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@3f4837668325e804c057a415e108d1393af3406a # github-actions under test (seantronsen/feat/decouple-trivy)
+    permissions:
+      contents: read          # baseline for checkout
+      packages: read          # read image versions
+      security-events: write  # SARIF upload to GHAS
+    with:
+      exit-code: '0'
+
+  validate:
+    # PR builds produce no packages (they're validated in build.yml).
+    if: ${{ github.event_name == 'push' }}
+    needs: goreleaser
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    with:
+      packages: |
+        - name: testbed-quadlet*
+          files:
+            - /etc/openchami/configs/testbed.yaml
+            - /usr/share/containers/systemd/testbed.container
+            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+          rpm-files:
+            - /usr/share/licenses/testbed-quadlet/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed-quadlet/copyright
+        # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet.
+        - name: testbed[-_][0-9]*
+          files:
+            - /usr/bin/testbed
+          rpm-files:
+            - /usr/share/licenses/testbed/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed/copyright
+
+  publish:
+    if: ${{ github.event_name == 'push' }}
+    needs: [goreleaser, validate]
+    permissions:
+      contents: write   # publish the draft GitHub Release
+    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
new file mode 100644
index 0000000..84d5cf8
--- /dev/null
+++ b/.github/workflows/reuse.yml
@@ -0,0 +1,23 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: reuse
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  reuse:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..0e4eb91
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: scorecard
+on:
+  branch_protection_rule:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '39 5 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    permissions:
+      contents: read          # baseline for checkout
+      security-events: write  # SARIF upload to GHAS
+      id-token: write         # publish results to the OpenSSF dashboard
+    uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+
+  scorecard:
+    if: ${{ always() }}
+    needs: [check]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
new file mode 100644
index 0000000..b5890be
--- /dev/null
+++ b/.github/workflows/stale.yml
@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: stale
+on:
+  schedule:
+    - cron: '23 3 * * *'  # daily at 03:23 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  stale:
+    uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment)
+    permissions:
+      issues: write          # label, comment on, and close stale issues
+      pull-requests: write   # label, comment on, and close stale PRs
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..61edeb0
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+name: test
+
+# All tests under one gate: the `test` job is the required status check.
+# Unit tests also upload coverage to Coveralls (README badge); the repo must
+# be enrolled in Coveralls.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  test-unit-go:
+    uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@94dcf268d84a4bf0396e2a93f56769199cd7cb7a # github-actions under test (seantronsen/feat/runner-selection)
+    with:
+      go-version-file: go.mod
+      coverage: true
+      runner: ubuntu-latest  # exercises the runner input (default: ubuntu-slim)
+
+  test:
+    if: ${{ always() }}
+    needs: [test-unit-go]
+    runs-on: ubuntu-slim
+    steps:
+      - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
+        with: { jobs: "${{ toJSON(needs) }}" }
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
new file mode 100644
index 0000000..76d6603
--- /dev/null
+++ b/.goreleaser.yaml
@@ -0,0 +1,182 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+#
+# Exercises every release effect of the OpenCHAMI/github-actions GoReleaser
+# workflows. Annotated reference:
+# https://github.com/OpenCHAMI/github-actions/blob/main/.goreleaser.example.yml
+
+version: 2
+
+project_name: github-actions-testbed
+
+before:
+  hooks:
+    - go mod tidy
+    # Pin the packaged quadlet to the image this run publishes.
+    - make quadlet-render IMAGE_TAG={{ .Tag }}
+
+builds:
+  - id: testbed
+    main: ./cmd/testbed
+    binary: testbed
+    goos: [linux]
+    goarch: [amd64, arm64]
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - >-
+        -s -w
+        -X main.version={{ .Version }}
+        -X main.commit={{ .Commit }}
+        -X main.buildHost={{ .Env.BUILD_HOST }}
+
+archives:
+  - id: testbed
+    ids: [testbed]
+    formats: [tar.gz]
+    files:
+      - LICENSES/*
+
+checksum:
+  name_template: "{{ .ProjectName }}_checksums.txt"
+
+dockers_v2:
+  - id: testbed
+    ids: [testbed]
+    dockerfile: Dockerfile
+    images:
+      - ghcr.io/openchami/github-actions-testbed
+    tags:
+      - "{{ .Tag }}"                                   # vX.Y.Z or pr-N
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}.{{ .Minor }}{{ end }}'
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}{{ end }}'
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}latest{{ end }}'
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      org.opencontainers.image.title: "{{ .ProjectName }}"
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed
+  # Second, distinctly named image (different title label, so a different
+  # digest) to exercise per-image attestation.
+  - id: testbed-alt
+    ids: [testbed]
+    dockerfile: Dockerfile
+    images:
+      - ghcr.io/openchami/github-actions-testbed-alt
+    tags:
+      - "{{ .Tag }}"                                   # vX.Y.Z or pr-N
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}.{{ .Minor }}{{ end }}'
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}{{ end }}'
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}latest{{ end }}'
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      org.opencontainers.image.title: "{{ .ProjectName }}-alt"
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed
+
+nfpms:
+  - id: testbed-quadlet
+    package_name: testbed-quadlet
+    meta: true
+    formats: [rpm, deb]
+    file_name_template: "{{ .ConventionalFileName }}"
+    vendor: OpenCHAMI
+    homepage: https://github.com/OpenCHAMI/github-actions-testbed
+    maintainer: "Sean Tronsen <sean.tronsen@gmail.com>"
+    description: Podman Quadlet test package for the OpenCHAMI github-actions workflows.
+    license: MIT
+    section: admin
+    contents:
+      - dst: /etc/openchami
+        type: dir
+      - dst: /etc/openchami/configs
+        type: dir
+      - src: packaging/configs/testbed.yaml
+        dst: /etc/openchami/configs/testbed.yaml
+        type: "config|noreplace"
+      - src: build/quadlet/testbed.container
+        dst: /usr/share/containers/systemd/testbed.container
+      - dst: /usr/share/containers/systemd/testbed.container.d
+        type: dir
+      - src: packaging/systemd/testbed.container.d/10-defaults.conf
+        dst: /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+      - dst: /usr/share/licenses/testbed-quadlet
+        type: dir
+        packager: rpm
+      - src: LICENSES/MIT.txt
+        dst: /usr/share/licenses/testbed-quadlet/MIT.txt
+        type: license
+        packager: rpm
+      - src: packaging/deb/copyright
+        dst: /usr/share/doc/testbed-quadlet/copyright
+        packager: deb
+    scripts:
+      postinstall: packaging/scripts/postinstall.sh
+      preremove: packaging/scripts/preremove.sh
+      postremove: packaging/scripts/postremove.sh
+    overrides:
+      rpm:
+        release: "1.el9"
+        dependencies:
+          - podman >= 5.0.0
+          - systemd
+      deb:
+        release: "1"
+        dependencies:
+          - podman (>= 5.0.0)
+          - systemd
+    rpm:
+      signature:
+        key_file: "{{ .Env.GPG_KEY_PATH }}"
+  # Binary package: one per goarch, so a single package glob matches several
+  # files across architectures.
+  - id: testbed
+    package_name: testbed
+    ids: [testbed]
+    formats: [rpm, deb]
+    file_name_template: "{{ .ConventionalFileName }}"
+    vendor: OpenCHAMI
+    homepage: https://github.com/OpenCHAMI/github-actions-testbed
+    maintainer: "Sean Tronsen <sean.tronsen@gmail.com>"
+    description: Test binary package for the OpenCHAMI github-actions workflows.
+    license: MIT
+    section: admin
+    contents:
+      - src: LICENSES/MIT.txt
+        dst: /usr/share/licenses/testbed/MIT.txt
+        type: license
+        packager: rpm
+      - src: packaging/deb/copyright
+        dst: /usr/share/doc/testbed/copyright
+        packager: deb
+    overrides:
+      rpm:
+        release: "1.el9"
+      deb:
+        release: "1"
+    rpm:
+      signature:
+        key_file: "{{ .Env.GPG_KEY_PATH }}"
+
+release:
+  disable: '{{ if eq .Env.IS_PR_BUILD "true" }}true{{ else }}false{{ end }}'
+  name_template: "v{{ .Version }}"
+  prerelease: auto
+  footer: |
+    ## Verifying packages
+
+    ```bash
+    rpm --import gpg-public-key.asc
+    rpm -K testbed-quadlet-*.rpm
+    ```
+
+changelog:
+  use: git
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..5062711
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,8 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+# Built by GoReleaser (dockers_v2): binaries come prebuilt in the context.
+FROM gcr.io/distroless/static
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/testbed /usr/bin/testbed
+ENTRYPOINT ["/usr/bin/testbed"]
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..28f9510
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+IMAGE_TAG   ?= $(shell git describe --tags --always --abbrev=0)
+QUADLET_DIR ?= build/quadlet
+
+.PHONY: all
+all: build
+
+.PHONY: build
+build: ## Build the binary
+	go build -o bin/testbed ./cmd/testbed
+
+.PHONY: test
+test: ## Run unit tests
+	go test -race ./...
+
+.PHONY: quadlet-render
+quadlet-render: ## Pin the quadlet image tag for packaging (accepts IMAGE_TAG, QUADLET_DIR)
+	mkdir -p $(QUADLET_DIR)
+	if ! grep -q '@IMAGE_TAG@' packaging/systemd/testbed.container; then \
+		echo "error: @IMAGE_TAG@ placeholder missing from testbed.container" >&2; \
+		exit 1; \
+	fi
+	sed 's|@IMAGE_TAG@|$(IMAGE_TAG)|' packaging/systemd/testbed.container > $(QUADLET_DIR)/testbed.container
+
+.PHONY: clean
+clean: ## Remove build outputs
+	rm -rf bin build dist
diff --git a/cmd/testbed/main.go b/cmd/testbed/main.go
new file mode 100644
index 0000000..5e05477
--- /dev/null
+++ b/cmd/testbed/main.go
@@ -0,0 +1,24 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+// SPDX-License-Identifier: MIT
+
+// Command testbed is a trivial binary used to exercise the
+// OpenCHAMI/github-actions build and release workflows.
+package main
+
+import "fmt"
+
+// Set via -ldflags by GoReleaser.
+var (
+	version   = "dev"
+	commit    = "none"
+	buildHost = "unknown"
+)
+
+// Info returns the build metadata line printed by the binary.
+func Info() string {
+	return fmt.Sprintf("testbed %s (commit %s, built on %s)", version, commit, buildHost)
+}
+
+func main() {
+	fmt.Println(Info())
+}
diff --git a/cmd/testbed/main_test.go b/cmd/testbed/main_test.go
new file mode 100644
index 0000000..80dd8f2
--- /dev/null
+++ b/cmd/testbed/main_test.go
@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+// SPDX-License-Identifier: MIT
+
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestInfo(t *testing.T) {
+	if got := Info(); !strings.HasPrefix(got, "testbed ") {
+		t.Fatalf("Info() = %q, want prefix %q", got, "testbed ")
+	}
+}
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..02e6168
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,3 @@
+module github.com/openchami/github-actions-testbed
+
+go 1.26
diff --git a/go.mod.license b/go.mod.license
new file mode 100644
index 0000000..380948c
--- /dev/null
+++ b/go.mod.license
@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+SPDX-License-Identifier: MIT
diff --git a/packaging/configs/testbed.yaml b/packaging/configs/testbed.yaml
new file mode 100644
index 0000000..5884a6c
--- /dev/null
+++ b/packaging/configs/testbed.yaml
@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+# Example config shipped as %config(noreplace) / a deb conffile.
+greeting: hello
diff --git a/packaging/deb/copyright b/packaging/deb/copyright
new file mode 100644
index 0000000..298dc4b
--- /dev/null
+++ b/packaging/deb/copyright
@@ -0,0 +1,25 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: github-actions-testbed
+Source: https://github.com/OpenCHAMI/github-actions-testbed
+
+Files: *
+Copyright: 2026 OpenCHAMI a Series of LF Projects, LLC
+License: MIT
+ MIT License
+ .
+ Copyright (c) 2026 OpenCHAMI a Series of LF Projects, LLC
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+ associated documentation files (the "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+ following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all copies or substantial
+ portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+ LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+ EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+ USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/packaging/deb/copyright.license b/packaging/deb/copyright.license
new file mode 100644
index 0000000..380948c
--- /dev/null
+++ b/packaging/deb/copyright.license
@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+SPDX-License-Identifier: MIT
diff --git a/packaging/scripts/postinstall.sh b/packaging/scripts/postinstall.sh
new file mode 100644
index 0000000..f76766f
--- /dev/null
+++ b/packaging/scripts/postinstall.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+#
+# Shared by the rpm (%post) and deb (postinst) packages. $1 tells them apart:
+# rpm passes the instance count (1 = install, 2+ = upgrade); deb passes
+# "configure", with the previously configured version in $2 on upgrade.
+
+upgrade=
+case "$1" in
+    configure) [ -n "$2" ] && upgrade=1 ;;
+    [0-9]*)    [ "$1" -ge 2 ] && upgrade=1 ;;
+esac
+
+systemctl daemon-reload || :
+if [ -n "$upgrade" ]; then
+    systemctl try-restart testbed.service || :
+fi
diff --git a/packaging/scripts/postremove.sh b/packaging/scripts/postremove.sh
new file mode 100644
index 0000000..ddb517c
--- /dev/null
+++ b/packaging/scripts/postremove.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+#
+# Shared by the rpm (%postun) and deb (postrm) packages.
+
+systemctl daemon-reload || :
diff --git a/packaging/scripts/preremove.sh b/packaging/scripts/preremove.sh
new file mode 100644
index 0000000..50605ee
--- /dev/null
+++ b/packaging/scripts/preremove.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+#
+# Shared by the rpm (%preun) and deb (prerm) packages. Stop the service only
+# on real removal: rpm passes 0, deb passes "remove".
+
+case "$1" in
+    0|remove)
+        systemctl stop testbed.service >/dev/null 2>&1 || :
+        ;;
+esac
diff --git a/packaging/systemd/testbed.container b/packaging/systemd/testbed.container
new file mode 100644
index 0000000..74e7ef0
--- /dev/null
+++ b/packaging/systemd/testbed.container
@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+[Unit]
+Description=OpenCHAMI github-actions testbed container
+
+[Container]
+ContainerName=%N
+Image=ghcr.io/openchami/github-actions-testbed:@IMAGE_TAG@
+
+[Service]
+Restart=on-failure
+
+[Install]
+WantedBy=default.target
diff --git a/packaging/systemd/testbed.container.d/10-defaults.conf b/packaging/systemd/testbed.container.d/10-defaults.conf
new file mode 100644
index 0000000..28dd851
--- /dev/null
+++ b/packaging/systemd/testbed.container.d/10-defaults.conf
@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+# SPDX-License-Identifier: MIT
+
+[Container]
+Environment=TESTBED=1
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..8ec9325
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "github>OpenCHAMI/.github//renovate-config/default",
+    "config:recommended"
+  ]
+}
diff --git a/renovate.json.license b/renovate.json.license
new file mode 100644
index 0000000..db315fb
--- /dev/null
+++ b/renovate.json.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+
+SPDX-License-Identifier: MIT