Migrate remaining pinned repositories off finding fingerprints #61

New issue

Open

opened 2026-09-25 09:22:20 -05:00 by kiyi · 1 comment

kiyi commented

2026-09-25 09:22:20 -05:00

Member

workflows#60 removes build-dependent fingerprint matching from the shared scanner. Comfy-UI and base-images have paired policy migrations in Comfy-UI#32 and base-images#21.

The other current repository policies still contain legacy fingerprint reviews on older pinned workflow releases: actual-budget (88), platform (30), and GitchAlerts (2), counted on 2026-09-25. They are not broken by v1.21.0 because their callers remain pinned to earlier releases, but they should be migrated deliberately rather than carried forward indefinitely.

Acceptance:

Review each legacy finding and replace it with the narrow stable selector appropriate to its scanner (for example CVE/package/version/severity/repository or source rule/path/severity); remove obsolete duplicate reviews.
Update each repository’s policy, documentation, and relevant workflow pins only after the shared release exists; preserve existing expiry, evidence, and controls.
Validate the policy and repository tests, then run each owning repository’s reviewed pipeline. Do not treat a selector migration as approval of new findings.

[workflows#60](https://git.gitchegumi.com/Homelab/workflows/pulls/60) removes build-dependent fingerprint matching from the shared scanner. Comfy-UI and base-images have paired policy migrations in [Comfy-UI#32](https://git.gitchegumi.com/Homelab/Comfy-UI/pulls/32) and [base-images#21](https://git.gitchegumi.com/Homelab/base-images/pulls/21). The other current repository policies still contain legacy fingerprint reviews on older pinned workflow releases: `actual-budget` (88), `platform` (30), and `GitchAlerts` (2), counted on 2026-09-25. They are not broken by v1.21.0 because their callers remain pinned to earlier releases, but they should be migrated deliberately rather than carried forward indefinitely. Acceptance: - Review each legacy finding and replace it with the narrow stable selector appropriate to its scanner (for example CVE/package/version/severity/repository or source rule/path/severity); remove obsolete duplicate reviews. - Update each repository’s policy, documentation, and relevant workflow pins only after the shared release exists; preserve existing expiry, evidence, and controls. - Validate the policy and repository tests, then run each owning repository’s reviewed pipeline. Do not treat a selector migration as approval of new findings.

kiyi added this to the Homelab Roadmap project

2026-09-25 09:22:20 -05:00

kiyi commented

2026-09-27 14:11:50 -05:00

Author

Member

Owner direction recorded 2026-09-27: every future image, bundle and recovery release must use a readable component/version name, such as gitchauth-theme-v1; deploy selectors must accept the exact signed name. No hashes in release names.

Release naming PR #64 prepares shared schema 2 publishers/readers for v1.24.0, with existing signed schema 1 release compatibility. Paired initial callers are Platform #76 and Documentation #17.

Remaining older pinned delivery callers must adopt the paired publisher/deploy/evidence version before their next release. Source policy checks on 2026-09-27 still reject the legacy actual-budget and GitchAlerts mitigation schemas; complete their stable finding migration in this existing tracker before raising their pins. Bundles, Comfy-UI and base-images also retain older delivery pins and need paired adoption. Existing expiry and owner controls must be preserved. No application build/deploy was dispatched, and no existing release was renamed.

Owner direction recorded 2026-09-27: every future image, bundle and recovery release must use a readable component/version name, such as `gitchauth-theme-v1`; deploy selectors must accept the exact signed name. No hashes in release names. [Release naming PR #64](https://git.gitchegumi.com/Homelab/workflows/pulls/64) prepares shared schema 2 publishers/readers for v1.24.0, with existing signed schema 1 release compatibility. Paired initial callers are [Platform #76](https://git.gitchegumi.com/Homelab/platform/pulls/76) and [Documentation #17](https://git.gitchegumi.com/Homelab/Documentation/pulls/17). Remaining older pinned delivery callers must adopt the paired publisher/deploy/evidence version before their next release. Source policy checks on 2026-09-27 still reject the legacy actual-budget and GitchAlerts mitigation schemas; complete their stable finding migration in this existing tracker before raising their pins. Bundles, Comfy-UI and base-images also retain older delivery pins and need paired adoption. Existing expiry and owner controls must be preserved. No application build/deploy was dispatched, and no existing release was renamed.