Repository navigation
CI hardening - #318
Merged
Merged
CI hardening#318
Conversation
- renovate: add top-level pinDigests to pin and maintain image/action digests - renovate: gate automerge rules to patch + digest update types - head-update.yaml: restrict the push trigger to the master branch so only default-branch pushes publish credentialed snapshot artifacts - release.yaml: add a non-cancelling concurrency group and guard the build and release jobs to the default branch - Dockerfile: pin golang and alpine base images by digest - build.yaml: remove the default value of the mode workflow_call input Signed-off-by: Sebastian Stauch <sebastian.stauch@sap.com>
gardener-prow
Bot
added
kind/enhancement
Contributor
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: axel7born The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
gardener-prow
Bot
added
the
approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/kind enhancement
/area networking
What this PR does / why we need it:
This ports the CI hardening measures from gardener/gardener-extension-networking-cilium#829 to this repository.
Changes:
pinDigests: trueso image/action digests are pinned and maintained, and build inputs cannot be swapped under a mutable tag. Gate everyautomerge: truepackage rule (golang/alpine, general gomod, gardener gomod group, github-actions) withmatchUpdateTypes: ["patch", "digest"]so only patch and digest bumps automerge.push:trigger to themasterbranch. This repo useshead-update.yamlfor its push/PR snapshot build instead of anon-release.yaml, so the measure is applied there. Only pushes to the default branch now publish credentialed snapshot artifacts; other branches are still validated throughpull_requestwithout publish credentials.concurrencygroup so a re-dispatch cannot race an in-flight release during the tag/publish/bump window, and guard both thebuildandrelease-to-github-and-bumpjobs so only dispatches from the default branch can mint a release.golang:1.27.4andalpine:3.24.4base images by digest (tags kept).FROM scratchis intentionally left unpinned.default: snapshotfrom themodeworkflow_callinput so callers must set the mode explicitly.No measures were skipped. M2 was adapted to this repo's
head-update.yamllayout (there is nonon-release.yaml).Release note: