chore(ci): unify check-image-pins.py with deployments via the org canonical copy (JDWLABS-451) - #384
Open
jdwillmsen wants to merge 3 commits into
Open
chore(ci): unify check-image-pins.py with deployments via the org canonical copy (JDWLABS-451)#384jdwillmsen wants to merge 3 commits into
jdwillmsen wants to merge 3 commits into
Conversation
…guard This repo's image-pin checker and deployments' were forks that had diverged into different programs, each catching defects the other missed. The script is now the canonical copy from jdwlabs/.github, byte-identical in both repos; this repo's scan scope (tenants/ and helm-charts/, with templates/ scanned for literal references) is declared in tools/image-pin-check.yaml instead of in the script. Rules gained from the deployments side, all of which were false negatives here: a digest-only `tag: "@sha256:…"` in a structured block composed to `repo:@sha256:…`, matched the digest regex and read as pinned; template lines with a trailing comment never matched the literal-reference regex; `.tpl` partials were not scanned; truncated digests and tags outside the OCI grammar were accepted. Unquoted numeric tags keep their literal text but are now reported as malformed and cannot be allowlisted, since Helm's own parser applies the same lossy conversion. check-remote-chart-image-pins.py keeps reusing the checker's loader and walker through the new refs_in_tree() entry point and passes its allowlist path explicitly. CI compares the vendored script and test file against jdwlabs/.github at a pinned commit and fails on any difference. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6
remote-chart-image-pin-check, gitsync-tenant-folders, and adr-numbering all run the shared test-discovery step, which imports the vendored check-image-pins.py at module load (test_check_image_pins.py execs it). A tampered vendored copy would run in these three jobs concurrently with, not after, the drift guard that's supposed to catch it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GzFwqYVWFmpgh5h1zNxuWQ
Bumps CANONICAL_REF to jdwlabs/.github@accde604 (post-merge of both JDWLABS-451's original convergence and the digest-only sibling-tag bypass fix found in independent review). The prior pin (e6ea75a8f0fb33b22434fa03b9163b78c8e9c2ef) was a PR-branch head SHA that could never become an ancestor of jdwlabs/.github main on a rebase-merge-only repo, so the drift guard would have stayed green against a permanently stale snapshot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GzFwqYVWFmpgh5h1zNxuWQ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces this repo's fork of the image-pin checker with the org-canonical copy from jdwlabs/.github#48, byte-identical to deployments'. Scan scope (
tenants/,helm-charts/, templates scanned for literal references) moves intotools/image-pin-check.yaml;check-remote-chart-image-pins.pykeeps reusing the checker through the newrefs_in_tree()entry point; theimage-pin-checkjob gains a drift guard thatcmps the script and test file against jdwlabs/.github at a pinned SHA.Merge order: jdwlabs/.github#48 → this PR (and jdwlabs/deployments' sibling PR, independent of this one).
CANONICAL_REFinvalidate.ymlcurrently points at the branch SHAe6ea75a8of #48 so CI can pass now; after #48 merges (squash rewrites the SHA) re-pin it to the merged commit before merging this.Divergence classification
tenants/+helm-charts/; deployments Helm-mergescharts/<chart>/values-<env>.yamlontovalues.yamland fails a chart with no overlaytree,helm-overlays)(path, ref)here vs(path, repository, tag)in deploymentsrefschema kept; deployments migrates1.10→1.1conversion)tag: "@sha256:…"in a structured block composed torepo:@sha256:…, matched the digest regex and read as pinned here# comment;.tplpartials never scannedregistry:/digest:fields, registry-only blocks,<name>Image/<name>Tagsibling keys, embedded ConfigMap manifests, URL/path/template filtering, dedupDigest-pinned:inventory,MALFORMEDsection and0 issueslineTest plan
python3 -m unittest discover -s tools/tests -t tools/tests— 228 tests OK (vendored union suite + remote-chart checker suite)python3 tools/check-image-pins.py— 18 digest-pinned, 26 allowlisted, 0 unexplained, 0 malformed; exit 0 (same counts as before)python3 tools/check-remote-chart-image-pins.py— 24/24 charts checked, 4 allowlisted, 0 unexplainedcmpclean againstjdwlabs/.github@e6ea75a8actionlint .github/workflows/validate.yml— only the pre-existing shellcheck warning on mainCANONICAL_REFre-pinned to the merged SHA of chore(ci): unify check-image-pins.py — add the canonical copy (JDWLABS-451) .github#48Refs JDWLABS-451.
🤖 Generated with Claude Code
https://claude.ai/code/session_016XRddumw4ZNvFqHSd9KSf6