Skip to content

Enforce Debian 13 across maintained paths #460

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jeremi wants to merge 35 commits into from
Closed

Enforce Debian 13 across maintained paths #460

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
5980f34
fix(release): enforce Debian 13 image boundary
jeremi Jul 23, 2026
a9e8aad
fix(release): reject untagged Debian image refs
jeremi Jul 23, 2026
db99552
fix(release): reject untagged workflow containers
jeremi Jul 23, 2026
5b769f0
fix(release): tighten Debian image boundary checks
jeremi Jul 23, 2026
6631ba6
fix(release): align tutorial cache boundary
jeremi Jul 23, 2026
f6b4c58
fix(release): cover image scanner parser gaps
jeremi Jul 23, 2026
0401069
fix(release): parse shell control prefixes
jeremi Jul 23, 2026
8eddb6c
fix(release): scope executable image scanning
jeremi Jul 23, 2026
2ccd556
fix(release): harden image surface parsing
jeremi Jul 23, 2026
7b77d10
fix(release): simplify image boundary scan
jeremi Jul 23, 2026
ef49840
fix(release): cover default Debian image families
jeremi Jul 23, 2026
d73c9e4
style(release): format image boundary scanner
jeremi Jul 23, 2026
21363b5
fix(release): scan OCI namespace variants
jeremi Jul 23, 2026
6f6c37e
fix(release): close image scanner bypasses
jeremi Jul 23, 2026
34ab475
fix(release): harden image scanner parsing
jeremi Jul 23, 2026
ba1e3b0
fix(release): fail closed on dynamic image surfaces
jeremi Jul 23, 2026
d97b33a
fix(release): reject computed image contexts
jeremi Jul 23, 2026
da12db3
fix(release): close image scanner bypasses
jeremi Jul 23, 2026
98da966
fix(release): bound image policy grammar
jeremi Jul 23, 2026
4399a04
fix(release): narrow Debian image boundary check
jeremi Jul 23, 2026
84d5b62
fix(release): close focused image contract gaps
jeremi Jul 23, 2026
758619e
fix(release): enforce bounded image stages
jeremi Jul 23, 2026
62a71b1
fix(release): allow canonical shell pin forms
jeremi Jul 23, 2026
9e58672
fix(release): close image contract overrides
jeremi Jul 23, 2026
539e219
fix(release): bind image consumers exactly
jeremi Jul 23, 2026
ba8558e
fix(release): reject positional image bypasses
jeremi Jul 23, 2026
9e28642
fix(release): pin exact builder command prefixes
jeremi Jul 23, 2026
542910d
Merge origin/main into agent/debian13-boundary
jeremi Jul 23, 2026
b1a797d
fix(release): inventory workflow image references
jeremi Jul 23, 2026
5b88e97
fix(release): close remaining image inventory gaps
jeremi Jul 23, 2026
16fac88
fix(release): inspect multiline Docker copy sources
jeremi Jul 23, 2026
46dc396
fix(release): restrict Docker copy option syntax
jeremi Jul 23, 2026
63da446
fix(release): enforce remaining image inputs
jeremi Jul 23, 2026
49fa0b6
fix(release): inventory exact Docker run steps
jeremi Jul 23, 2026
e6289df
fix(release): bind workflow images to roles
jeremi Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,9 @@ jobs:
echo "registryctl_tutorial=${registryctl_tutorial}"
} >> "${GITHUB_OUTPUT}"

- name: Check Debian 13 image contract

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

This reviewed commit has no Signed-off-by: trailer in git show -s --format=full 532223d9510028a20423654ee854600af302b921, so it violates the repo's DCO requirement and needs to be recommitted or squashed with git commit -s before it satisfies the contribution rules.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

This reviewed commit (git show -s --format=full 855be52238896bf469ec03d8050dd9e12d4dac8d) still has no Signed-off-by: trailer, so it does not satisfy the repository's DCO requirement and will need to be recommitted or squashed with sign-off before it can pass contribution policy.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

Fresh evidence for this review is that git show -s --format=%B 868deaa57d3598ca4f6cabab8670895d9ae8c821 contains no Signed-off-by: trailer, so this commit still cannot satisfy the repository DCO policy until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

Fresh evidence for this review is that git show -s --format=%B 868deaa57d3598ca4f6cabab8670895d9ae8c821 contains no Signed-off-by: trailer, so this commit still cannot satisfy the repository DCO policy until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

Fresh evidence for this review is that git show -s --format=%B 87d2703dadebad6059289f3b06e542bc2edf786e has no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO policy until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

Fresh evidence for this review is that git show -s --format=%B 87d2703dadebad6059289f3b06e542bc2edf786e has no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO policy until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off this commit

Fresh evidence for this review is that git show -s --format=%B faef5ed58c71b0f41e46dfc17b741a284fc7e209 contains no Signed-off-by: trailer, so this commit still violates the repository DCO requirement and needs to be recommitted or squashed with sign-off before it can satisfy contribution policy.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B 3b75344ed88e74b30aef501d42100295a21d328c contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this reviewed commit is that git show -s --format=%B 90ca17727f7f3c629c57f6c666ea922ad88e000c contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B 13dc99d1401a0e2e7598a58330ac42c6e9b62d5f contains no Signed-off-by: trailer, but the repository requires every commit to be signed off, so this PR will keep failing the contribution policy until the commit is recommitted or squashed with git commit -s.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this reviewed commit is that git show -s --format=%B 7b5c68df55136ac7e248ee6d9e878cdb07da9211 has no Signed-off-by: trailer, so this contribution cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B 99d901bb47d88493c75d3f5466455153a44635c6 contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

run: python3 release/scripts/check-debian13-images.py
Comment on lines +170 to +171

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B a5ab69375fa1040175c203c1e2c2102c52a77181 contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

Comment on lines +170 to +171

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B a6931c2055322e885360acc68edc50daeedc74c2 contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

Comment on lines +170 to +171

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B ac79237bf310cbc0cf589ee8b3ff88e5647dc8c0 contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

Comment on lines +170 to +171

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B 588f026b959d658d131bb82a839f5c35a7659ae3 contains no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B f25350624a4fa90c32c17e4818f1622e07447413 has no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO policy until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B f25350624a4fa90c32c17e4818f1622e07447413 has no Signed-off-by: trailer, so this commit cannot satisfy the repository DCO policy until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this reviewed commit is that git show -s --format=%B 95d3fd36af3663bcf8db492a0d2315b2ba4cfa28 has no Signed-off-by: trailer, so this contribution cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Install PyYAML before running the contract

In the always-run changes job, this new step executes before any setup or dependency installation, but check-debian13-images.py now imports the third-party yaml module at import time. On runners or fresh checkouts without PyYAML (there is no requirements/venv setup in this job), python3 release/scripts/check-debian13-images.py exits with ModuleNotFoundError before producing outputs, so even unrelated PRs can fail CI before the path filters are usable.

Useful? React with 👍 / 👎.

Comment on lines +170 to +171

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Sign off the reviewed commit

Fresh evidence for this review is that git show -s --format=%B 8dc9e3365da6599d1b9c8272d11f5ec4d7025089 contains no Signed-off-by: trailer, so this commit still cannot satisfy the repository DCO requirement until it is recommitted or squashed with sign-off.

AGENTS.md reference: AGENTS.md:L70-L70

Useful? React with 👍 / 👎.


secrets:
name: Secret scan
runs-on: ubuntu-24.04
Expand Down Expand Up @@ -507,6 +510,9 @@ jobs:
- name: Test release helper
run: python3 -m unittest release/scripts/test_registry_release.py

- name: Test Debian 13 image contract checker
run: python3 -m unittest release/scripts/test_check_debian13_images.py

- name: Test release planning commands
run: python3 -m unittest release/scripts/test_registry_release_plans.py

Expand Down Expand Up @@ -644,9 +650,7 @@ jobs:
path: |
target/registryctl-tutorial-cargo-home
target/registryctl-tutorial-linux-amd64
key: registryctl-tutorial-${{ runner.os }}-rust-1.95.0-${{ hashFiles('Cargo.lock') }}
restore-keys: |
registryctl-tutorial-${{ runner.os }}-rust-1.95.0-
key: registryctl-tutorial-${{ runner.os }}-${{ hashFiles('docs/site/scripts/check-registryctl-tutorials.sh') }}-${{ hashFiles('Cargo.lock') }}

- name: Execute registryctl tutorials from source
working-directory: docs/site
Expand Down
2 changes: 1 addition & 1 deletion crates/registry-relay/scripts/run-live-consultation-journey.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ set +v
set -euo pipefail
umask 077

readonly POSTGRES_IMAGE="postgres:16"
readonly POSTGRES_IMAGE="postgres:16.13-alpine"

[[ "$#" -le 1 ]] || {
printf '%s\n' "usage: $0 [dhis2|rhai|synthetic]" >&2
Expand Down
2 changes: 1 addition & 1 deletion docs/site/scripts/check-registryctl-tutorials.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ REPO_ROOT="$(cd "$SITE_ROOT/../.." && pwd)"
HELPER="$SITE_ROOT/scripts/registryctl-tutorial.mjs"
RELAY_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx"
NOTARY_TUTORIAL="$SITE_ROOT/src/content/docs/tutorials/verify-claim-registry-api.mdx"
BUILDER_IMAGE="rust:1.95-bookworm@sha256:4c2fd73ef19c5ef9d54bee03b06b2839a392604fbfcd578ed948b71b37c1d7fb"
BUILDER_IMAGE="rust:1.95-trixie@sha256:f49565f188ee00bc2a18dd418183f2c5f23ef7d6e691890517ed341a598f67c3"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Key the tutorial cache by builder image

After this line moves the tutorial build container from Bookworm to Trixie, the registryctl-tutorials workflow still restores target/registryctl-tutorial-linux-amd64 with the unchanged cache key registryctl-tutorial-${{ runner.os }}-rust-1.95.0-... in .github/workflows/ci.yml. On a cache hit from before this change, Cargo can consider the existing binaries fresh because the source and Rust version did not change, so this tutorial gate can keep packaging Bookworm-built artifacts instead of exercising the new Debian 13 builder until the cache naturally misses.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Split docs and release changes

This same commit changes a docs/site tutorial script while also adding release checker/tests and root CI wiring, which crosses the docs and release ownership boundaries. The repository guidance asks changes to stay scoped to one owning area, so this should be split or narrowed before review can apply the right owner checks.

Useful? React with 👍 / 👎.

LINUX_TARGET="$REPO_ROOT/target/registryctl-tutorial-linux-amd64"
CARGO_HOME_DIR="$REPO_ROOT/target/registryctl-tutorial-cargo-home"
NATIVE_TARGET="$REPO_ROOT/target/registryctl-tutorial-native"
Expand Down
Loading
Loading