Repository navigation
fix: scope registry credentials, harden CI/CD, bump dependencies - #3
Merged
Merged
Conversation
…ndling - New auth.py: write a private (0600) docker config that only contains the target registry, so credentials are no longer offered to the source registries. Previously two configs were created for src+dst and the second silently overwrote the first. - Use the https://index.docker.io/v1/ key for Docker Hub. - Pass the auth env to docker/podman/helm too (credentials were ignored there) and authenticate 'helm push' via HELM_REGISTRY_CONFIG. - --ca-cert is appended to the system CA bundle instead of replacing it, and is honoured by helm. - Add --password-stdin, REGISTRY_USERNAME/REGISTRY_PASSWORD and --auth-registry; warn on --password; require username and password together. - Remove duplicated per-tool auth/cleanup blocks in images.py. - README: correct nonroot UID (65532), drop useless /root mounts, document auth. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013XXYXZzMgKN2pShvj9LqVJ
…ptions - Split requirements into runtime (pyyaml), build (pyinstaller, setuptools) and dev (pytest, bandit, pip-audit); bump pyyaml 6.0.3, setuptools 84.2.1, pyinstaller 6.22.3. The shipped binary no longer lists bandit & co. - Validate image refs from charts (reject leading '-', whitespace, shell chars) before they become command arguments; parse numbers as strings so 'tag: 1.10' is no longer mirrored as 1.1. - Add --retries (exponential backoff) and --exclude-image. - Add unit tests (22) and a CI workflow: pytest on 3.10/3.13, bandit, pip-audit, PyInstaller smoke build. - Pin all GitHub Actions to commit SHAs at their latest releases, add Dependabot for pip/actions/docker, timeouts, concurrency, persist-credentials. - Docker publish and the 6-hourly rebuild now build -> smoke test -> Trivy gate (fixable HIGH/CRITICAL) -> push, instead of pushing first. The rebuild uses --no-cache so apk upgrade sees new packages. - Binary release: read-only build job, separate release job with contents:write, sha256 checksum attached. - Docs: new flags, development section, SECURITY notes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013XXYXZzMgKN2pShvj9LqVJ
…ings The Docker PR build reused the cached 'apk upgrade' layer, so the Trivy gate could flag packages that a fresh build would already have fixed. Pass the run id as APK_REFRESH build arg, and split the Trivy step into a SARIF report and a table-format gate so a failure shows which vulnerabilities caused it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013XXYXZzMgKN2pShvj9LqVJ
crane is always present in the image and is preferred by tool detection, so skopeo was never used there. It was the only package behind the 13 fixable HIGH Go-library findings that made the Trivy gate fail. skopeo remains supported as a copy tool on host installs. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013XXYXZzMgKN2pShvj9LqVJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up review of v0.2.6–v0.2.9 (registry auth, CA cert, skopeo, scheduled rebuild).
Security fixes
src/auth.pywrites a private (0600) config containing only the target host and removes it afterwards.https://index.docker.io/v1/auth key; auth env is passed to docker/podman/helm too, andhelm pushis authenticated (HELM_REGISTRY_CONFIG).--ca-certis appended to the system CA bundle instead of replacing it, and is used by helm.--password-stdin,REGISTRY_USERNAME/REGISTRY_PASSWORD,--auth-registry; warning on--password; username and password must be given together.-, whitespace or shell characters).tag: 1.10) are no longer parsed as float1.1.Features
--retries N(exponential backoff),--exclude-image GLOB(repeatable).Dependencies
Pipeline
ci.yml: pytest (3.10, 3.13), bandit (-ll), pip-audit, PyInstaller smoke build.persist-credentials: false.latestrebuild: build → smoke test → Trivy gate (fixable HIGH/CRITICAL) → push. Before, images were pushed before being scanned. The rebuild usesno-cachesoapk upgradeactually picks up new packages.contents: write, sha256 checksum attached./rootmounts) and documented the new options.Notes / please check
apk worldworkaround is unchanged and the new Docker smoke/Trivy gate will run for the first time in this PR's CI. If the gate trips on a fixable CVE, that is intended.crane. Not tested against real registries.Generated by Claude Code