chore(ci): unify check-image-pins.py — add the canonical copy (JDWLABS-451) - #48
Merged
Merged
Conversation
… repos deployments and platform each carried their own fork of the image-pin checker. They had diverged far enough that each repo caught defects the other missed: one preserved the literal text of an unquoted numeric tag but let a digest-only `tag:` read as pinned, the other rejected digest-only tags but crashed on numeric ones and skipped trailing-comment template lines. This is the union of both rule sets, parameterised per repo by a tools/image-pin-check.yaml (scan sources + allowlist path) so the script itself is byte-identical everywhere. Consumers vendor this file and its test file and compare them against this repo at a pinned commit in CI, the same SHA-pin convention already used for reusable workflows. tools-tests.yml gates changes here, which is the only PR signal a shared script gets before it propagates. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
deployments/tools/check-image-pins.pyandplatform/tools/check-image-pins.pywere forks of the same digest-pinning gate that had diverged into two different programs. This PR adds the canonical, merged copy undertools/here, with the union of both test suites, atools-tests.ymlgate, and adocs/ci-standards.mdsection recording the vendoring convention. The delivery-repo PRs (deployments, platform) vendor this file byte-for-byte and add a CI drift guard pinned to a commit SHA in this repo — this PR must merge first, and those two must then be re-pinned from the branch SHA to the merged SHA.Divergence classification
charts/<chart>/values-<env>.yamlontovalues.yamland fails a chart with no overlay; platform globs every YAML undertenants/+helm-charts/helm-overlays,tree) intools/image-pin-check.yaml(path, repository, tag)vs(path, ref)ref= full composed reference; deployments allowlist migrated (7 entries)1.10→1.1in the message); platform preserves literal text but treats it as an ordinary, allowlistable violationtag: "@sha256:…"rejected in deployments only; platform composedrepo:@sha256:…which matched the digest regex and read as pinnedrepo@sha256:…strings stay valid (deployments wrongly flagged those)registry:/digest:fields, registry-only blocks,<name>Image/<name>Tagsibling keys, embedded ConfigMap manifests, non-reference filtering (URLs, paths, templates), multi-document files# commentsand scans.tpl; platform's regex missed any line with a trailing comment and never scanned.tplDigest-pinned:inventory,0 issuesline,MALFORMED/UNCHECKED CHARTSsections)check-remote-chart-image-pins.py(platform) reuses the checker's loader/walkerrefs_in_tree()Mechanism
Shared script + per-repo config file (not flags): the repo-specific part is the whole discovery model, which is too large to express as flags. Drift guard =
cmpagainstraw.githubusercontent.com/jdwlabs/.github/<sha>/tools/…in each consumer's image-pin job, following the SHA-pin decision for reusable workflows recorded indocs/ci-standards.md.Test plan
python3 -m unittest discover -s tools/tests -t tools/tests— 107 tests, OK (1 skip: the real-repo integrity test needs a per-repo config)actionlint .github/workflows/tools-tests.ymlRefs JDWLABS-451.
🤖 Generated with Claude Code
https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6