WIP: Reuse base-image routing, validation and required gate after #87 #88
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!88
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/shared-base-image-ci"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Base-images still owns local routing, definition-validation and aggregate-gate jobs. Add reusable
select-base-images.yml,validate-base-images.ymlandrequire-base-image-scans.ymlso the owning callers can delegate all CI orchestration to the released workflow library without dropping checks.This branch starts at
kiyi/security-runtime(5ac7af9a79), and this PR targets that branch to show only the follow-up. Merge #87 and get the security image accepted first. After #87 merges, retarget this PR tomain; do not merge this follow-up into #87 before then. It remains WIP to preserve that ordering.The shared jobs preserve
select,validateandscanIDs/display names, complete PR comparison history, explicit image/tool matrices, an always-run fail-closed gate, checksum-verified lint tools, runtime-integrity tests, generated-evidence checks, Buildx/Hadolint and blocking Trivy configuration checks. Repository-owned rules, tests and tool locks remain candidate inputs. Registry pull credentials are forwarded explicitly and only used with the exact registry host. No signing or deployment credentials are added.v1.33.0 does not contain these new workflows. Publish a subsequent immutable release through the reviewed release pipeline before adopting them, then update all caller
uses/library_refpins together to that latest release. The adoption guide contains the concrete caller replacements and requires hosted verification of unchanged emitted required-check names. No active caller is pointed at an unpublished workflow.Validation: 315 library tests passed with 2 native scanner tests skipped because local Gitleaks/Trivy are unavailable; scaffold YAML/Bash checks and all 16 mocked cases passed; pinned Ruff 0.16.8 and ShellCheck 0.10.0 passed. Source comparison confirmed every existing check is retained. No local container builds/runtime checks or protected release/publication dispatches were performed.
The immediate runner fix is independent in base-images#40: commit 141960758d switches to same-instance reuse and matching v1.33.0 pins. Run 161 started the shared build on a runner. Complete image screening remains pending its hosted result.
Refs #86 and base-images#39.
Closing as requested. The tested reusable routing, definition-validation and aggregate-gate implementation is now in #87 at 4f71b3e89e, with 45ba309c2e updating the adoption guide for the consolidated review. This PR has no unique commits left. Continue all security-image workflow work in #87; the image definition and scan fixes remain in base-images#40.
Pull request closed