From 3be1d2da480f7a1780262c85e55ba22819d946b3 Mon Sep 17 00:00:00 2001 From: chgl Date: Sun, 20 Sep 2026 15:28:31 +0200 Subject: [PATCH 1/2] feat: update digest in chart --- .github/workflows/standard-chart-publish.yaml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/workflows/standard-chart-publish.yaml b/.github/workflows/standard-chart-publish.yaml index b23922a..f6be06a 100644 --- a/.github/workflows/standard-chart-publish.yaml +++ b/.github/workflows/standard-chart-publish.yaml @@ -48,6 +48,16 @@ on: required: false default: true type: boolean + image-digest: + description: "Digest (sha256:...) of the app image to pin in the packaged chart's values.yaml before bundling, typically the build job's own output (e.g. needs.build.outputs.image-digest) rather than looked up again here. Combined with the tag already at image-tag-path as `@`. Only affects the package built for publishing - never committed back to the repo. Leave empty to publish the chart unmodified." + required: false + default: "" + type: string + image-tag-path: + description: "yq path to the app image tag in the chart's values.yaml, read and then overwritten with `@` when image-digest is set." + required: false + default: ".image.tag" + type: string target-branch: description: "Branch to diff against when detecting changed charts for linting/testing" required: false @@ -395,6 +405,23 @@ jobs: echo "app-version=${APP_VERSION}" } >> "${GITHUB_OUTPUT}" + - name: Pin app image tag to its digest + if: ${{ inputs.image-digest != '' }} + working-directory: ${{ inputs.chart-path }} + env: + IMAGE_DIGEST: ${{ inputs.image-digest }} + TAG_PATH: ${{ inputs.image-tag-path }} + run: | + # only ever touches this job's own checked-out working copy - never + # committed back. helm package (next step) bundles whatever's on + # disk here, so the published chart ends up pinned to the exact + # image the caller's build job produced, without values.yaml in + # the repo ever changing or a second, possibly-racy lookup of what + # the tag currently resolves to. + TAG="$(yq "${TAG_PATH}" values.yaml)" + yq -i "${TAG_PATH} = \"${TAG}@${IMAGE_DIGEST}\"" values.yaml + echo "Pinned ${TAG_PATH} in values.yaml: ${TAG} -> ${TAG}@${IMAGE_DIGEST}" + - name: Package chart id: package env: From 077abcfa1d8ab96b5b6de36a687ccc8bb24bf76e Mon Sep 17 00:00:00 2001 From: chgl Date: Sun, 20 Sep 2026 15:33:46 +0200 Subject: [PATCH 2/2] choreAfeat: bumped runner image to v26 and replaced unmaintained actionlint --- .github/workflows/ci.yaml | 15 +---------- .github/workflows/standard-build.yaml | 25 +++++------------ .github/workflows/standard-chart-publish.yaml | 6 ++--- .github/workflows/standard-lint.yaml | 27 ++++++++++++++----- .github/workflows/standard-release.yaml | 2 +- .github/workflows/standard-schedule.yaml | 4 +-- .mega-linter.yml | 1 + 7 files changed, 35 insertions(+), 45 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9febe4f..61b4677 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -106,24 +106,11 @@ jobs: github-token: ${{ secrets.GITHUB_TOKEN }} test: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 name: test needs: - build steps: - # - # via - - name: Set up containerd image store - shell: bash - run: | - [ -f /etc/docker/daemon.json ] || echo "{}" | sudo tee /etc/docker/daemon.json - jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json - sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json - cat /etc/docker/daemon.json - sudo systemctl restart docker - - docker info -f '{{ .DriverStatus }}' - - name: Set up Docker Buildx uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 diff --git a/.github/workflows/standard-build.yaml b/.github/workflows/standard-build.yaml index 6157274..bb51ea3 100644 --- a/.github/workflows/standard-build.yaml +++ b/.github/workflows/standard-build.yaml @@ -117,7 +117,7 @@ on: jobs: build: name: build image - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 permissions: contents: read packages: write # to push the image to ghcr.io @@ -144,19 +144,6 @@ jobs: with: persist-credentials: false - # - # via - - name: Set up containerd image store - shell: bash - run: | - [ -f /etc/docker/daemon.json ] || echo "{}" | sudo tee /etc/docker/daemon.json - jq '. | .+{"features": {"containerd-snapshotter": true}}' /etc/docker/daemon.json > /tmp/docker-daemon-with-containerd.json - sudo mv /tmp/docker-daemon-with-containerd.json /etc/docker/daemon.json - cat /etc/docker/daemon.json - sudo systemctl restart docker - - docker info -f '{{ .DriverStatus }}' - - name: Set up Docker Buildx id: setup-buildx uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 @@ -386,7 +373,7 @@ jobs: image-provenance: name: attest image provenance - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ startsWith(github.ref, 'refs/tags/') }} needs: - build @@ -432,7 +419,7 @@ jobs: sign-image: name: sign image - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ github.event_name != 'pull_request' }} needs: - build @@ -470,7 +457,7 @@ jobs: attest-trivy-vulnerability-report: name: attest trivy vulnerability report - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ github.event_name != 'pull_request' && inputs.enable-trivy-scan }} needs: - build @@ -514,7 +501,7 @@ jobs: upload-attestion-to-release: name: upload slsa attestations to release assets - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ startsWith(github.ref, 'refs/tags/') }} needs: - image-provenance @@ -549,7 +536,7 @@ jobs: upload-sbom-to-release: name: upload image SBOMs to release assets - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 needs: - build permissions: diff --git a/.github/workflows/standard-chart-publish.yaml b/.github/workflows/standard-chart-publish.yaml index f6be06a..f4466f2 100644 --- a/.github/workflows/standard-chart-publish.yaml +++ b/.github/workflows/standard-chart-publish.yaml @@ -129,7 +129,7 @@ on: jobs: lint: name: lint charts - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - name: Harden Runner uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 @@ -216,7 +216,7 @@ jobs: install: name: install charts (k8s ${{ matrix.k8s-version }}) - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ inputs.enable-install }} needs: - lint @@ -344,7 +344,7 @@ jobs: publish: name: publish chart - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 needs: - lint if: ${{ github.event_name == 'release' || (github.event_name == 'pull_request' && inputs.enable-pr-release) }} diff --git a/.github/workflows/standard-lint.yaml b/.github/workflows/standard-lint.yaml index aa9d65e..8c8b348 100644 --- a/.github/workflows/standard-lint.yaml +++ b/.github/workflows/standard-lint.yaml @@ -62,7 +62,7 @@ on: jobs: megalinter: name: MegaLinter - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ github.event_name == 'pull_request' }} permissions: issues: write # for megalinter to post PR comments via the issue comments API @@ -96,9 +96,24 @@ jobs: megalinter-reports mega-linter.log + actionlint: + name: actionlint + runs-on: ubuntu-26.04 + if: ${{ github.event_name == 'pull_request' }} + permissions: + contents: read + steps: + - name: Checkout Code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run actionlint + uses: kjanat/actionlint@08bb2c4f0d039744455b87aef1c647fb8b66d37b # v1.17.0 + dependency-review: name: dependency review - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 # can only run on PRs or the error is: # "Both a base ref and head ref must be provided, either via the `base_ref`/`head_ref` config options, or by running a `pull_request`/`pull_request_target` workflow." if: ${{ github.event_name == 'pull_request' }} @@ -114,7 +129,7 @@ jobs: gradle-wrapper-validation: name: validate gradle wrapper - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ inputs.enable-validate-gradle-wrapper }} permissions: contents: read @@ -128,7 +143,7 @@ jobs: base-image-signature-verification: name: verify Dockerfile base image signature - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ inputs.enable-verify-base-image-signature }} permissions: contents: read @@ -153,7 +168,7 @@ jobs: codeql-analyze: name: CodeQL analyze - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ inputs.enable-codeql }} permissions: actions: read # required by github/codeql-action to upload SARIF results @@ -217,7 +232,7 @@ jobs: zizmor: name: zizmor scan - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 if: ${{ github.event_name == 'pull_request' }} permissions: security-events: write # for uploading zizmor SARIF results diff --git a/.github/workflows/standard-release.yaml b/.github/workflows/standard-release.yaml index 5026f03..a79e034 100644 --- a/.github/workflows/standard-release.yaml +++ b/.github/workflows/standard-release.yaml @@ -28,7 +28,7 @@ on: jobs: release: name: release - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 # run only on pushes. The semantic release default config allows releases # to only be created from the default branch ('master'). The ci.yaml # is configured to only run on pushes to master as well. diff --git a/.github/workflows/standard-schedule.yaml b/.github/workflows/standard-schedule.yaml index 08efd31..778831f 100644 --- a/.github/workflows/standard-schedule.yaml +++ b/.github/workflows/standard-schedule.yaml @@ -27,7 +27,7 @@ env: jobs: check-links: name: check links using lychee - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 permissions: issues: write # to open/update the link check report issue steps: @@ -74,7 +74,7 @@ jobs: trivy-scan: name: scan images with trivy - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 strategy: matrix: image: ${{ fromJSON(inputs.images) }} diff --git a/.mega-linter.yml b/.mega-linter.yml index 323d683..2059ddf 100644 --- a/.mega-linter.yml +++ b/.mega-linter.yml @@ -9,6 +9,7 @@ DISABLE_LINTERS: - SPELL_LYCHEE - REPOSITORY_OSV_SCANNER - ACTION_ZIZMOR + - ACTION_ACTIONLINT ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES: - GITHUB_TOKEN