CI hardening

.github/renovate.json5

@@ -7,15 +7,19 @@
   ],
   "labels": ["kind/enhancement"],
   "postUpdateOptions": ["gomodTidy"],
+  // Pin and maintain image/action digests so build inputs cannot be swapped under a mutable tag.
+  "pinDigests": true,
   "separateMinorPatch": true,
   "packageRules": [
     {
       "matchDatasources": ["docker", "go-version"],
       "matchPackagePatterns": ["golang", "alpine"],
+      "matchUpdateTypes": ["patch", "digest"],
       "automerge": true
     },
     {
       "matchManagers": ["gomod"],
+      "matchUpdateTypes": ["patch", "digest"],
       "automerge": true
     },
     {
@@ -25,6 +29,7 @@
       matchPackageNames: [
         '/^github\\.com/gardener/',
       ],
+      "matchUpdateTypes": ["patch", "digest"],
       "automerge": true
     },
     {
@@ -33,6 +38,7 @@
         "^actions/checkout$",
         "^actions/setup-go$",
       ],
+      "matchUpdateTypes": ["patch", "digest"],
       "automerge": true
     },
     {

.github/workflows/build.yaml

@@ -6,7 +6,6 @@ on:
       mode:
         required: true
         type: string
-        default: snapshot
         description: |
           the mode to use. either `snapshot` or `release`. Will affect effective version, as well
           as target-oci-registry.

.github/workflows/head-update.yaml

@@ -1,6 +1,10 @@
 name: Build
 on:
+  # Only pushes to the default branch publish credentialed snapshot
+  # artifacts; other branches are validated through pull_request without publish credentials.
   push:
+    branches:
+      - master
   pull_request:
 
 jobs:

.github/workflows/release.yaml

@@ -9,8 +9,19 @@ on:
           - bump-patch
 
 
+# Serialize release runs so a re-dispatch cannot run concurrently with an in-flight
+# release and race the tag/publish/bump window. Never cancel an in-progress release:
+# a half-published release must finish, not be interrupted.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build:
+    # Only dispatches from the default branch may mint a release. Repo-global tags mean
+    # a dispatch from any ref would otherwise publish the real version tag, bypassing
+    # branch protection.
+    if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
     uses: ./.github/workflows/build.yaml
     with:
       mode: release
@@ -21,6 +32,7 @@ jobs:
       packages: write
 
   release-to-github-and-bump:
+    if: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
     uses: gardener/cc-utils/.github/workflows/release.yaml@v1
     needs:
       - build

Dockerfile

@@ -1,5 +1,5 @@
 #############      builder              #############
-FROM --platform=${BUILDPLATFORM} golang:1.27.4 AS builder
+FROM --platform=${BUILDPLATFORM} golang:1.27.4@sha256:08bcb99a38f85a265f9a93d1d3323e2440eec333380f3ea26ee0dec9264bb41c AS builder
 
 WORKDIR /go/src/github.com/gardener/apiserver-proxy
 COPY . .
@@ -16,7 +16,7 @@ RUN go mod download
 RUN make build GOARCH=$TARGETARCH EFFECTIVE_VERSION=$EFFECTIVE_VERSION
 
 #############      apiserver-proxy-builder      #############
-FROM alpine:3.24.4 AS apiserver-proxy-builder
+FROM alpine:3.24.4@sha256:f59abe656b692d901e184be3445e084786602108599d2a51d229c0f5a48c71bf AS apiserver-proxy-builder
 
 RUN apk add --no-cache iproute2-minimal