Share base-image discovery, build, scan and protected publication #77
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!77
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/shared-base-image-pipeline"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Base-image candidates need one reusable pipeline rather than per-image scan orchestration. Adds discover-base-images.yml plus base-image.yml: discover all implemented images folders, source-scan each selected folder, build Dockerfile smoke checks, scan the complete image, retain per-image sanitized reports, and optionally sign/publish through the existing protected owner-dispatch guards. Reuses container.py and existing security/evidence contracts. No tool-image pipeline is introduced.
Companion caller changes are in base-images#26, commit 597af6a. They remove the bespoke Ubuntu scanner and duplicated manual publication steps, and pin both uses/library_ref to the planned v1.28.0 release. Review/merge this library change, then publish the next unused minor release through Publish workflow release before adopting those callers. No release has been published or protected workflow dispatched here.
Validation at
038addd: 3 discovery/publication/report-retention contract tests passed; both workflow YAML files parsed and every embedded shell script passed syntax checks; discovery against current base-images returned comfy-python, pytorch-cuda and ubuntu; git diff --check passed. Caller release/matrix/no-publication/no-secrets contracts also passed. Both commit identities and SSH authentication verified as kiyi. Hosted library checks and reusable matrix execution remain pending.Candidate callers pass no signing/registry-write/deployment secrets. Forgejo 16 ignores permissions; documentation corrects the earlier claim of read-only automatic token enforcement. The disposable ci worker and existing approval/access controls remain the execution boundary.
The earlier Ubuntu candidate run built and passed smoke checks, then correctly blocked CVE-2026-84782 in libssl3t64 and openssl-provider-legacy at 3.5.5-1ubuntu3.5. That finding is not suppressed by this refactor and remains a base-images acceptance blocker.
New commits pushed, approval review dismissed automatically according to repository settings
Fixed the failure from Library checks run 493 in
06702c9. The suite ran 256 tests with one failure: the report-upload contract still expected 7 upload steps, while base-image.yml adds the eighth.The test now checks the exact expected workflow names (including base-image.yml), so a missing, duplicate or unexpected upload is detected. Every upload still must retain summary.md/findings.csv and exclude raw files and recursive wildcards. No scan gate or runtime behavior changed.
Validation: all 7 reporting tests passed locally, including integrated pass/rejection/scanner-error reporting; git diff --check passed. Commit author/committer and SSH authentication verified as kiyi. New hosted checks are queued; their result is pending.