chore: propagate changes from main into development - #1315
Merged
Merged
Conversation
The verify-toolchain-pin job installed regctl via regctl-installer with the action's default 'latest' release, so a new regctl could change this required check's behavior without any change in the repo. Pin it to an explicit released version (v0.11.6) for reproducibility. Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS
verify-toolchain-pin.bats: add the branches flagged as uncovered in the
prebuilt-toolchain-image review —
* same-repo run where the pinned :$KEY tag does not resolve in GHCR
-> hard exit 1 (failure-closed)
* CHARON_TOOLCHAIN_DIGEST blank / ARG line absent -> hard exit 1
toolchain-key.bats: add per-input sensitivity cases for the tonistiigi/xx
pin and the ALPINE_IMAGE pin (each change flips the recomputed key; an
unchanged re-emit keeps it stable).
Helper gains TF_XX_PIN / TF_ALPINE_IMAGE knobs and a
tf_stub_regctl_unresolvable mock (image digest exits non-zero), reusing
the existing PATH-stub pattern.
Also harden verify-toolchain-pin.sh's arg_value(): a missing ARG line now
yields empty output instead of aborting the script under 'set -e' before
the actionable CHARON_TOOLCHAIN_DIGEST error can print.
Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS
Nothing in CI builds the app image via the caddy-inline / crowdsec-inline
path end to end, so the fork / air-gapped / not-logged-in-to-GHCR
fallback (from-source Caddy + CrowdSec compile) can rot silently until
someone tries to build offline.
Add .github/workflows/build-offline.yml: an amd64-only, advisory (NOT
required) canary that runs 'make build-offline' with GHA layer caching.
* workflow_dispatch + weekly schedule (Wed 08:00 UTC, clear of the
existing cron cluster) catch upstream drift.
* pull_request with a tight paths filter (Dockerfile, .dockerignore,
Makefile, the workflow itself) re-validates only when the inline
recipe can actually change — the ~20-min job doesn't run on every PR.
* permissions: contents:read only (the inline path pulls nothing from
GHCR — that's the point); no registry login, no push, no multi-arch.
* smoke step asserts the from-source caddy/crowdsec/cscli/charon
binaries landed in the final image and 'caddy version' runs.
Makefile: parametrize build-offline with overridable DOCKER_BUILD /
BUILD_OFFLINE_ARGS so CI reuses the target (single source of truth for
the two builder-src selectors) while adding buildx --platform/--load/
--cache flags. Default local behavior unchanged.
docs/ci/toolchain-image.md: note the new canary in the components table.
Claude-Session: https://claude.ai/code/session_01KXA4x9LrA2AsnLrvdHMZbS
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Contributor
Author
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to propagate changes from main into development.
Triggered by push to main.