sneak/upaas
1
0
Fork 0
Code Issues 14 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix: pin all external refs to cryptographic identity (closes #118) #119

Merged
sneak merged 1 commits from fix/pin-external-refs-crypto-identity into main 2026-02-23 20:48:09 +01:00
Conversation 3 Commits 1 Files Changed 1 +4 -4
clawbot commented 2026-02-20 19:45:17 +01:00
Collaborator
Copy Link

Changes

  • Dockerfile: Pin golang:1.25-alpine and alpine:3.19 base images to sha256 digests
  • Dockerfile: Pin golangci-lint to v2.10.1 and goimports to v0.42.0 (was @latest)
  • CI workflow actions were already pinned to commit SHAs — no changes needed

make check output

All checks passed with zero failures.

Closes #118

## Changes - **Dockerfile**: Pin `golang:1.25-alpine` and `alpine:3.19` base images to sha256 digests - **Dockerfile**: Pin `golangci-lint` to `v2.10.1` and `goimports` to `v0.42.0` (was `@latest`) - CI workflow actions were already pinned to commit SHAs — no changes needed ## `make check` output All checks passed with zero failures. Closes #118
sneak was assigned by clawbot 2026-02-20 19:45:17 +01:00
clawbot added 1 commit 2026-02-20 19:45:17 +01:00
fix: pin all external refs to cryptographic identity (closes #118)
All checks were successful
Check / check (pull_request) Successful in 11m25s
Details
e367c2dd5b 
- Dockerfile: Pin golang and alpine base images to sha256 digests
- Dockerfile: Pin golangci-lint to v2.10.1 and goimports to v0.42.0
- CI workflows already pinned to commit SHAs (no changes needed)
clawbot added the
needs-review
 label 2026-02-20 20:43:28 +01:00
clawbot commented 2026-02-20 20:43:28 +01:00
Author
Collaborator
Copy Link

Pipeline sweep: PR is mergeable and CI checks passed. No code review yet — labeling needs-review. Spawning review agent.

Pipeline sweep: PR is mergeable and CI checks passed. No code review yet — labeling `needs-review`. Spawning review agent.
clawbot commented 2026-02-20 20:44:58 +01:00
Author
Collaborator
Copy Link

Code Review: PR #119

Summary

Clean, focused PR that pins Docker base images to SHA256 digests and Go tool installs to specific versions in the Dockerfile. Only 1 file changed, 4 lines modified.

Checks

  • make check passes — all lints, tests, and build succeed with zero failures
  • No linter/test/CI config changes — .golangci.yml, Makefile, and .gitea/workflows/ are untouched
  • No regressions — identical test results to main

Changes Reviewed

  • Dockerfile:1 — golang:1.25-alpine pinned to golang@sha256:f6751d... with tag comment. GOOD.
  • Dockerfile:4 — golangci-lint@latest pinned to @v2.10.1. GOOD.
  • Dockerfile:5 — goimports@latest pinned to @v0.42.0. GOOD.
  • Dockerfile:23 — alpine:3.19 pinned to alpine@sha256:6baf43... with tag comment. GOOD.

Minor Observation (non-blocking)

The Go tool installs in the Dockerfile use semver tags (@v2.10.1, @v0.42.0) while the CI workflow uses commit SHAs. Both are acceptable since Go module proxy serves immutable checksum-verified content for version tags. Using commit SHAs in the Dockerfile too would be maximally consistent but is cosmetic.

Verdict: LGTM

PR achieves its stated goal cleanly. All external Docker image references use cryptographic digests. Go tool versions are pinned. No config weakening. Ready to merge.

## Code Review: PR #119 ### Summary Clean, focused PR that pins Docker base images to SHA256 digests and Go tool installs to specific versions in the Dockerfile. Only 1 file changed, 4 lines modified. ### Checks - **make check passes** — all lints, tests, and build succeed with zero failures - **No linter/test/CI config changes** — .golangci.yml, Makefile, and .gitea/workflows/ are untouched - **No regressions** — identical test results to main ### Changes Reviewed - Dockerfile:1 — golang:1.25-alpine pinned to golang@sha256:f6751d... with tag comment. GOOD. - Dockerfile:4 — golangci-lint@latest pinned to @v2.10.1. GOOD. - Dockerfile:5 — goimports@latest pinned to @v0.42.0. GOOD. - Dockerfile:23 — alpine:3.19 pinned to alpine@sha256:6baf43... with tag comment. GOOD. ### Minor Observation (non-blocking) The Go tool installs in the Dockerfile use semver tags (@v2.10.1, @v0.42.0) while the CI workflow uses commit SHAs. Both are acceptable since Go module proxy serves immutable checksum-verified content for version tags. Using commit SHAs in the Dockerfile too would be maximally consistent but is cosmetic. ### Verdict: LGTM PR achieves its stated goal cleanly. All external Docker image references use cryptographic digests. Go tool versions are pinned. No config weakening. Ready to merge.
clawbot added
merge-ready
 and removed
needs-review
 labels 2026-02-20 20:45:06 +01:00
clawbot force-pushed fix/pin-external-refs-crypto-identity from e367c2dd5b to 0ed2d02dfe 2026-02-21 09:50:46 +01:00 Compare
clawbot commented 2026-02-21 09:50:53 +01:00
Author
Collaborator
Copy Link

Updated: replaced version tags (@v2.10.1, @v0.42.0) with commit SHAs to match CI workflow and ensure true cryptographic pinning.

make check: ✅ All checks passed!

Reviewed the diff — all Docker FROM statements and go install commands in the repo now use cryptographic identity (sha256 digests / commit SHAs). The CI workflow was already correctly pinned.

Updated: replaced version tags (`@v2.10.1`, `@v0.42.0`) with commit SHAs to match CI workflow and ensure true cryptographic pinning. `make check`: ✅ All checks passed! Reviewed the diff — all Docker `FROM` statements and `go install` commands in the repo now use cryptographic identity (sha256 digests / commit SHAs). The CI workflow was already correctly pinned.
sneak merged commit dc638a07f1 into main 2026-02-23 20:48:09 +01:00
sneak deleted branch fix/pin-external-refs-crypto-identity 2026-02-23 20:48:10 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

Something is not working

  
duplicate

This issue or pull request already exists

  
enhancement

New feature

  
help wanted

Need some help

  
invalid

Something is wrong

  
merge-ready

All checks pass, reviewed, rebased, ready for merge

  
merge-ready

   
needs-checks

make check does not pass cleanly

  
needs-checks

   
needs-rebase

PR has merge conflicts or is behind main

  
needs-rebase

   
needs-review

Code review not yet done

  
needs-review

   
needs-rework

Code review found issues to fix

  
needs-rework

   
notplanned

   
question

More information is needed

  
wontfix

This won't be fixed

No Label
bug
duplicate
enhancement
help wanted
invalid
merge-ready
merge-ready
needs-checks
needs-checks
needs-rebase
needs-rebase
needs-review
needs-review
needs-rework
needs-rework
notplanned
question
wontfix
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
sneak
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: sneak/upaas#119
No description provided.
Delete Branch "fix/pin-external-refs-crypto-identity"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?