Pass explicit registry host to base-image full scans #81

Merged

gitchegumi merged 1 commit from kiyi/base-image-scan-registry-host into main

2026-10-08 11:46:15 -05:00

kiyi commented

2026-10-08 11:30:23 -05:00

Member

Map the existing inputs.registry_host to SCAN_REGISTRY_HOST alongside the credential pair. The existing validated input still supplies REGISTRY_HOST for the parent login. No new caller input, organization variable, credential, permission or scanner exception is introduced. Refs #80 and base-images#32.

Validation: three new regressions invoke the real archived-image scanner with the actual workflow mappings and mocked external commands. They prove the corrected scan proceeds, removing the hostname reproduces run 117’s exact failure, and neither Trivy nor malware export receives credentials for another host. Base-image and Forgejo contract suites pass (26 tests total; eight Windows symlink subtests unavailable). Pinned Ruff and git diff checks pass. No container was built or run locally.

After reviewed merge, publish immutable workflow patch release v1.30.1 through this repository’s protected release workflow. Base-images PR #33 adopts matching uses/library_ref pins; hosted full scans remain pending. Leave #80 open through release/adoption verification.

Authenticated base-image builds succeed at parent login, then fail before full image scanning because the reusable scan step supplies REGISTRY_HOST but omits the scanner’s required SCAN_REGISTRY_HOST. This caused [base-images run 117](https://git.gitchegumi.com/Homelab/base-images/actions/runs/117/jobs/3/attempt/1) to stop after the Forgejo runner image built and passed smoke checks. Map the existing `inputs.registry_host` to SCAN_REGISTRY_HOST alongside the credential pair. The existing validated input still supplies REGISTRY_HOST for the parent login. No new caller input, organization variable, credential, permission or scanner exception is introduced. Refs #80 and [base-images#32](https://git.gitchegumi.com/Homelab/base-images/issues/32). Validation: three new regressions invoke the real archived-image scanner with the actual workflow mappings and mocked external commands. They prove the corrected scan proceeds, removing the hostname reproduces run 117’s exact failure, and neither Trivy nor malware export receives credentials for another host. Base-image and Forgejo contract suites pass (26 tests total; eight Windows symlink subtests unavailable). Pinned Ruff and git diff checks pass. No container was built or run locally. After reviewed merge, publish immutable workflow patch release `v1.30.1` through this repository’s protected release workflow. [Base-images PR #33](https://git.gitchegumi.com/Homelab/base-images/pulls/33) adopts matching uses/library_ref pins; hosted full scans remain pending. Leave #80 open through release/adoption verification.

kiyi added 1 commit

2026-10-08 11:30:23 -05:00

Pass explicit registry host to base-image full scans

Workflow acceptance / acceptance (pull_request) Successful in 1m34s

Details

Repository security / security-1 (pull_request) Successful in 7m52s

Details

Library checks / tests (pull_request) Successful in 7m59s

Details

d74f4e221e

kiyi referenced this pull request

2026-10-08 11:40:41 -05:00