Pass the registry hostname to base-image full scans #80

New issue

Closed

opened 2026-10-08 11:29:56 -05:00 by kiyi · 2 comments

kiyi commented

2026-10-08 11:29:56 -05:00

Member

base-images run 117 built the in-house Forgejo runner and passed its build-time smoke checks, then stopped before full image scanning with Private registry credentials require an explicit registry hostname.

The caller already supplies the existing REGISTRY_HOST variable through inputs.registry_host. The shared base-image scan/build step sets REGISTRY_HOST for the parent login, but omits SCAN_REGISTRY_HOST, which the scanner requires alongside its credential pair even when scanning a local archive.

Map the same validated registry_host input to SCAN_REGISTRY_HOST in the shared scan step.
Reproduce the failure and verify the corrected workflow mapping against the real scanner using mocked external commands.
Confirm credentials stay restricted to the matching registry hostname.
Publish the reviewed patch release and adopt matching uses/library_ref pins in base-images before rerunning acceptance.

Image work remains tracked by base-images#32 in Roadmap Review and PR #33. No new organization variable or credential is required.

[base-images run 117](https://git.gitchegumi.com/Homelab/base-images/actions/runs/117/jobs/3/attempt/1) built the in-house Forgejo runner and passed its build-time smoke checks, then stopped before full image scanning with `Private registry credentials require an explicit registry hostname`. The caller already supplies the existing REGISTRY_HOST variable through `inputs.registry_host`. The shared base-image scan/build step sets REGISTRY_HOST for the parent login, but omits SCAN_REGISTRY_HOST, which the scanner requires alongside its credential pair even when scanning a local archive. - [x] Map the same validated registry_host input to SCAN_REGISTRY_HOST in the shared scan step. - [x] Reproduce the failure and verify the corrected workflow mapping against the real scanner using mocked external commands. - [x] Confirm credentials stay restricted to the matching registry hostname. - [x] Publish the reviewed patch release and adopt matching uses/library_ref pins in base-images before rerunning acceptance. Image work remains tracked by [base-images#32](https://git.gitchegumi.com/Homelab/base-images/issues/32) in Roadmap Review and [PR #33](https://git.gitchegumi.com/Homelab/base-images/pulls/33). No new organization variable or credential is required.

kiyi referenced this issue

2026-10-08 11:30:23 -05:00

Pass explicit registry host to base-image full scans #81

kiyi commented

2026-10-08 11:40:41 -05:00

Author

Member

Implemented in PR #81, commit d74f4e2. The shared full-scan step now forwards the existing validated registry_host input as SCAN_REGISTRY_HOST.

Validation: 26 source tests pass, including reproduction of the run-117 missing-host error, corrected mapping through the real scanner with external commands mocked, and credential isolation for a different hostname. Eight Windows symlink subtests are unavailable; pinned Ruff and diff checks pass.

base-images PR #33, commit c70f1322ef, prepares matching v1.30.1 candidate/publication pins. This issue remains open until PR #81 is merged, v1.30.1 is published through the owning protected release workflow, and full image acceptance is verified.

Implemented in [PR #81](https://git.gitchegumi.com/Homelab/workflows/pulls/81), commit d74f4e2. The shared full-scan step now forwards the existing validated registry_host input as SCAN_REGISTRY_HOST. Validation: 26 source tests pass, including reproduction of the run-117 missing-host error, corrected mapping through the real scanner with external commands mocked, and credential isolation for a different hostname. Eight Windows symlink subtests are unavailable; pinned Ruff and diff checks pass. [base-images PR #33](https://git.gitchegumi.com/Homelab/base-images/pulls/33), commit c70f1322ef, prepares matching v1.30.1 candidate/publication pins. This issue remains open until PR #81 is merged, v1.30.1 is published through the owning protected release workflow, and full image acceptance is verified.

kiyi commented

2026-10-08 12:49:03 -05:00

Author

Member

The hostname correction is released in v1.30.1, following the reviewed merge of PR #81, and adopted by the matching base-images callers.

Run 121’s Forgejo runner image job passed the source and complete-image Trivy/ClamAV gates. The Docker engine also reached its image scan without scanner errors; its two advisory findings are separately addressed in base-images PR #33 and issue #32.

Closing this hostname bug based on the released caller adoption and successful full runner scan. Engine acceptance, tool-image publication and UDS adoption remain tracked in base-images.

The hostname correction is released in [v1.30.1](https://git.gitchegumi.com/Homelab/workflows/releases/tag/v1.30.1), following the reviewed merge of [PR #81](https://git.gitchegumi.com/Homelab/workflows/pulls/81), and adopted by the matching base-images callers. [Run 121’s Forgejo runner image job](https://git.gitchegumi.com/Homelab/base-images/actions/runs/121/jobs/3/attempt/1) passed the source and complete-image Trivy/ClamAV gates. The Docker engine also reached its image scan without scanner errors; its two advisory findings are separately addressed in [base-images PR #33](https://git.gitchegumi.com/Homelab/base-images/pulls/33) and [issue #32](https://git.gitchegumi.com/Homelab/base-images/issues/32). Closing this hostname bug based on the released caller adoption and successful full runner scan. Engine acceptance, tool-image publication and UDS adoption remain tracked in base-images.

kiyi closed this issue

2026-10-08 12:49:04 -05:00