Record security tool image decision and staged adoption #38

Merged

gitchegumi merged 3 commits from kiyi/security-runtime into main

2026-10-12 22:19:49 -05:00

kiyi commented

2026-10-11 21:13:31 -05:00

Member

Implementation: Homelab/base-images#40 and Homelab/workflows#87. Tracking remains open in Homelab/base-images#39 and Homelab/workflows#86, both in Roadmap Review. Public documentation links the public workflow procedure at its verified commit; private implementation references remain plain text.

Validation: npm run check and npm run build passed with the exact locked dependencies; git diff --check passed and the public diff was reviewed for secret values.

This records prepared source, not signed image publication, caller adoption, live deployment or measured performance improvements.

Record the owner’s 2026-10-11 decision to bake released workflows v1.33.0 and verified tools into a dedicated security job image. Document the review, independent signed publication, next workflow release, caller adoption and rollback sequence, with actual embedded-library provenance and fresh scan databases preserved. Implementation: https://git.gitchegumi.com/Homelab/base-images/pulls/40 and https://git.gitchegumi.com/Homelab/workflows/pulls/87. Tracking remains open in Homelab/base-images#39 and Homelab/workflows#86, both in Roadmap Review. Public documentation links the public workflow procedure at its verified commit; private implementation references remain plain text. Validation: npm run check and npm run build passed with the exact locked dependencies; git diff --check passed and the public diff was reviewed for secret values. This records prepared source, not signed image publication, caller adoption, live deployment or measured performance improvements.

kiyi added 1 commit

2026-10-11 21:13:31 -05:00

Record security tool image decision and staged adoption

Source security / security (pull_request) Successful in 1m55s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate (pull_request) Successful in 2m11s

Details

d9f0cc2e39

kiyi added 1 commit

2026-10-11 23:03:42 -05:00

Record patched security toolchain and approved Go mitigation scope

Source security / security (pull_request) Successful in 1m52s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate (pull_request) Successful in 2m58s

Details

cda3520b6b

portegumi reviewed

2026-10-12 14:35:13 -05:00

portegumi left a comment

Reviewed the two-page documentation diff at cda3520: it correctly distinguishes prepared source from signed image publication, workflow release, caller adoption, deployment and measured savings; documentation checks are green. Keep this as a decision/sequence record, not readiness evidence. At the time of this review, base-images #40 hosted run 181 still fails compiling Trivy (parser/parameter.go: undefined: json.SkipFunc), and workflows #87 depends on an accepted signed image. Neither image acceptance nor Harbor deployment is established by this docs PR. No documentation-only blocker.

Reviewed the two-page documentation diff at cda3520: it correctly distinguishes prepared source from signed image publication, workflow release, caller adoption, deployment and measured savings; documentation checks are green. Keep this as a decision/sequence record, not readiness evidence. At the time of this review, base-images #40 hosted run 181 still fails compiling Trivy (`parser/parameter.go: undefined: json.SkipFunc`), and workflows #87 depends on an accepted signed image. Neither image acceptance nor Harbor deployment is established by this docs PR. No documentation-only blocker.

portegumi added 1 commit

2026-10-12 18:21:35 -05:00

Merge main into security-runtime documentation

Source security / security (pull_request) Successful in 1m57s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate (pull_request) Successful in 1m8s

Details

3915bd2fff

Preserve the security-image rollout procedure and the independent Gitleaks local-installation guidance in their own subsections. No policy was superseded.