chore(ci): unify check-image-pins.py with platform via the org canonical copy (JDWLABS-451) - #210
Merged
Conversation
…guard This repo's image-pin checker and platform's were forks that had diverged into different programs, each catching defects the other missed. The script is now the canonical copy from jdwlabs/.github, byte-identical in both repos; this repo's chart layout (values-<env>.yaml overlays merged onto values.yaml, plus literal template lines) is declared in tools/image-pin-check.yaml instead of in the script. Rules gained from the platform side: registry/digest fields and registry-only image blocks, <name>Image/<name>Tag sibling keys, manifests embedded in ConfigMap strings, multi-document files, and literal-text preservation for unquoted numeric tags (still reported malformed). A raw `repo@sha256:…` string with no tag is now accepted as pinned rather than misreported as a digest-only tag. The allowlist is keyed on (path, ref) where ref is the full composed reference; the seven existing entries are migrated in place. CI compares the vendored script and test file against jdwlabs/.github at a pinned commit and fails on any difference. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces this repo's fork of the image-pin checker with the org-canonical copy from jdwlabs/.github#48, byte-identical to platform's. Repo layout (Helm-merged
values-<env>.yamloverlays + literal template lines) moves intotools/image-pin-check.yaml; the allowlist is migrated to the shared(path, ref)schema; theimage-pin-checkjob gains a drift guard thatcmps the script and test file against jdwlabs/.github at a pinned SHA.Merge order: jdwlabs/.github#48 → this PR (and jdwlabs/platform's sibling PR, independent of this one).
CANONICAL_REFinci.ymlcurrently points at the branch SHAe6ea75a8of #48 so CI can pass now; after #48 merges (squash rewrites the SHA) re-pin it to the merged commit before merging this.Divergence classification
charts/<chart>/values-<env>.yamlontovalues.yamland fails a chart with no overlay; platform globs every YAML undertenants/+helm-charts/helm-overlays,tree)(path, repository, tag)here vs(path, ref)in platformref= full composed reference; 7 entries migrated here1.1); platform kept literal text but allowed it to be allowlistedtag: "@sha256:…"rejected here only; platform read it as pinnedrepo@sha256:…strings (which this repo wrongly flagged) are validregistry:/digest:fields, registry-only blocks,<name>Image/<name>Tagsibling keys, embedded ConfigMap manifests, multi-doc files, URL/path/template filtering# commenton template lines,.tplscanningDigest-pinned:inventory and0 issueslineTest plan
python3 -m unittest discover -s tools -p 'test_*.py'— 143 tests OK (the vendored suite is the union of both repos' suites)python3 tools/check-image-pins.py— 6 digest-pinned, 7 allowlisted, 0 unexplained, 0 malformed; exit 0 (same counts as before)cmpclean againstjdwlabs/.github@e6ea75a8actionlint .github/workflows/ci.yml— only the two pre-existing shellcheck warnings on mainCANONICAL_REFre-pinned to the merged SHA of chore(ci): unify check-image-pins.py — add the canonical copy (JDWLABS-451) .github#48Refs JDWLABS-451.
🤖 Generated with Claude Code
https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6