feat: support scoped registry1 parent-image pulls #133
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!133
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/base-image-registry1-auth"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Registry1-derived Core image patches need authenticated parent pulls. Add optional
registry1_parent_pullstobase-image.yml,preinstalled-base-image.ymlandvalidate-base-images.yml, using the existing UDS registry credential pair only forregistry1.dso.mil. The default remains off.All three workflows use disposable Docker configuration, reject missing credential pairs and clear UDS credentials before subsequent commands. Existing scan names, gates, publication guards and the preinstalled image activation/provenance contract remain intact.
Run 1065 caught the missing preinstalled wrapper change in the existing operation-parity test. Commit
5a4398agives both build entry points the same optional authentication and extends the real-shell mocked credential/cleanup cases to cover the preinstalled path. The parity assertion remains unchanged.Validation: 556 Linux unit/contract tests completed successfully (20 tool/integration-dependent cases skipped locally), plus the native Windows Git-path workflow-channel case passed separately. The original failing security-image operation-parity test and credential cleanup cases pass. YAML/Bash validation and 16 mocked gate cases, Ruff, staged-diff checks and native Gitleaks passed. Hosted acceptance and full tool/integration checks remain required; no local image build or deployment was performed.
Merge, publish and promote this workflow change before adopting the new input in base-images #57.
Reviewed exact head
2f5a0a8055and the full changed workflow steps, test hunks, and documentation. The optional input defaults off; both build and definition validation scope UDS credential login to registry1.dso.mil, reject missing pairs, use disposable Docker configuration with EXIT cleanup, and unset the UDS credentials before later commands. Existing image scanning, signing/publication guard, and check names remain in place. This is parent-image pull authentication, not a UDS deployment, admission, or routing change; no gateway or bundle changes are warranted. Source approved. Exact-head Library, acceptance, repository-security and image-compatibility checks remain pending and must pass before merge; no live image build/deployment was verified.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
New commits pushed, approval review dismissed automatically according to repository settings
Reviewed exact head
5a4398aa98, including full source for all three workflow entry points and the new real-shell credential tests. The preinstalled path now matches the standard build path: opt-in boolean defaults false, fixed registry1.dso.mil login requires both UDS secrets, and both paths use disposable DOCKER_CONFIG with EXIT cleanup and unset the UDS credential variables before the build. Validation preserves Dockerfile checks and its existing scan-registry auth; publication protections, artifact retention and preinstalled runtime provenance remain intact. This changes authenticated parent pulls, not UDS deployment, routing, admission or gateway ownership. No source blocker found. Prior own approval was on an older SHA; this verdict applies only to the current head. Exact-head Library, acceptance, repository-security and security-image compatibility checks are pending; source approval is not scan acceptance or merge authorization. No image build or deployment verified.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.