Skip to content

audit: idempotency, consistency, and hardening improvements #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
atngit2 merged 7 commits into from
Apr 1, 2026
Merged

audit: idempotency, consistency, and hardening improvements #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
387bd1f
fix: push metadata commit to current branch, not hardcoded main
atngit2 Apr 1, 2026
adc69b1
chore: update build metadata [skip ci]
actions-user Apr 1, 2026
59e369b
fix: use correct branch names for cache-handler and transform-encoder
atngit2 Apr 1, 2026
6b39e89
fix(renovate): use config:recommended, fix automerge scope, add versi…
atngit2 Apr 1, 2026
cda4a81
fix(workflow): correct actions/checkout SHA comment from v6.0.2 to v4…
atngit2 Apr 1, 2026
caa67fa
fix: update docker/setup-qemu-action and docker/setup-buildx-action t…
atngit2 Apr 1, 2026
ff2062e
chore: update build metadata [skip ci]
actions-user Apr 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions .github/renovate.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:base"],
"extends": ["config:recommended"],
"timezone": "America/Los_Angeles",
"schedule": ["every weekend"],
"prCreation": "not-pending",
"automerge": true,
"automerge": false,
"automergeType": "pr",
"automergeStrategy": "squash",
"labels": ["dependencies", "docker"],
Expand All @@ -26,6 +26,12 @@
"automerge": true,
"commitMessageTopic": "go module {{depName}}"
},
{
"matchDatasources": ["github-releases"],
"matchUpdateTypes": ["minor", "patch"],
"automerge": true,
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Enabling automerge for github-releases is risky given the changes to the cosign and docker-scout custom managers (lines 53-74). Since those managers have been updated to only track the version string and explicitly require manual SHA256 updates, any automated version bump will result in a checksum mismatch in the workflow. If automerge is set to true, Renovate will attempt to merge these broken updates automatically if CI passes (or if the checksum check is not part of the CI gate). It is safer to set this to false to ensure a human verifies and updates the corresponding SHA256 before merging.

Suggested change
"automerge": true,
"automerge": false,

"commitMessageTopic": "github release {{depName}}"
},
{
"matchUpdateTypes": ["major"],
"automerge": false,
Expand All @@ -46,25 +52,25 @@
},
{
"customType": "regex",
"description": "Update cosign version and SHA in workflow",
"description": "Update cosign version in workflow (version field only; SHA256 must be updated manually or via a separate manager)",
"fileMatch": ["^\\.github/workflows/build-caddy\\.yml$"],
"matchStrings": [
"COSIGN_VERSION: (?<currentValue>v[^\\n]+)(?:\\n\\s+#[^\\n]*)*\\n\\s+COSIGN_SHA256: \"(?<currentDigest>[a-f0-9]+)\""
"COSIGN_VERSION: (?<currentValue>v[^\\n]+)"
],
"datasourceTemplate": "github-releases",
"depNameTemplate": "sigstore/cosign",
"extractVersionTemplate": "^(?<version>.*)$"
"versioningTemplate": "semver"
Comment on lines +55 to +62
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This customManager now updates only COSIGN_VERSION, but the workflow enforces a pinned COSIGN_SHA256 for the downloaded binary. A Renovate PR that bumps the version without updating the SHA will reliably break CI at the SHA verification step. Consider managing the SHA alongside the version again (single regex manager capturing both), or disabling Renovate updates/automerge for these fields until both values can be updated together.

Copilot uses AI. Check for mistakes.
},
{
"customType": "regex",
"description": "Update docker-scout version and SHA in workflow",
"description": "Update docker-scout version in workflow (version field only; SHA256 must be updated manually or via a separate manager)",
"fileMatch": ["^\\.github/workflows/build-caddy\\.yml$"],
"matchStrings": [
"SCOUT_VERSION: (?<currentValue>v[^\\n]+)(?:\\n\\s+#[^\\n]*)*\\n\\s+SCOUT_SHA256: \"(?<currentDigest>[a-f0-9]+)\""
"SCOUT_VERSION: (?<currentValue>v[^\\n]+)"
],
"datasourceTemplate": "github-releases",
"depNameTemplate": "docker/scout-cli",
"extractVersionTemplate": "^(?<version>.*)$"
"versioningTemplate": "semver"
Comment on lines 65 to +73
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same issue as cosign: this manager updates only SCOUT_VERSION, but the workflow verifies the downloaded tarball against SCOUT_SHA256. Renovate version-only bumps will fail CI unless the SHA is updated in the same PR. Consider updating both fields together (or preventing Renovate from proposing these updates until SHA automation is added).

Copilot uses AI. Check for mistakes.
}
]
}
30 changes: 18 additions & 12 deletions .github/workflows/build-caddy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
# STEP 1 — Checkout
# ──────────────────────────────────────────────────────────
- name: Checkout Repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.ref_name }}
fetch-depth: 0
Expand Down Expand Up @@ -159,15 +159,17 @@ jobs:
)"

echo "Resolving cache-handler HEAD commit..."
# caddyserver/cache-handler uses 'master' as its default branch (not 'main').
CACHE_HANDLER_REF="$(
retry git ls-remote --heads https://github.com/caddyserver/cache-handler.git \
| awk '/refs\/heads\/main/ {print $1}'
| awk '/refs\/heads\/master/ {print $1}'
)"

echo "Resolving transform-encoder HEAD commit..."
# caddyserver/transform-encoder uses 'master' as its default branch (not 'main').
TRANSFORM_ENCODER_REF="$(
retry git ls-remote --heads https://github.com/caddyserver/transform-encoder.git \
| awk '/refs\/heads\/main/ {print $1}'
| awk '/refs\/heads\/master/ {print $1}'
)"

echo "Resolving caddy-security version..."
Expand Down Expand Up @@ -332,7 +334,7 @@ jobs:
- name: Cache CLI tools
if: steps.decide.outputs.should_build == 'true'
id: cache-cli
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
with:
path: |
~/.local/bin/cosign
Expand Down Expand Up @@ -382,14 +384,14 @@ jobs:

- name: Login to DockerHub
if: steps.decide.outputs.should_build == 'true'
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
with:
username: ${{ env.DOCKERHUB_USERNAME }}
password: ${{ env.DOCKERHUB_TOKEN }}

- name: Login to GHCR
if: steps.decide.outputs.should_build == 'true'
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
with:
registry: ${{ env.GHCR_REGISTRY }}
username: ${{ github.actor }}
Expand All @@ -401,7 +403,7 @@ jobs:
- name: Build Local Test Image
if: steps.decide.outputs.should_build == 'true'
timeout-minutes: 30
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
with:
context: ./docker/caddy
platforms: linux/amd64
Expand Down Expand Up @@ -549,7 +551,7 @@ jobs:
if: steps.decide.outputs.should_build == 'true'
id: push
timeout-minutes: 60
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
with:
context: ./docker/caddy
platforms: linux/amd64,linux/arm64
Expand Down Expand Up @@ -679,6 +681,10 @@ jobs:

# ──────────────────────────────────────────────────────────
# STEP 12 — Commit and push metadata (always runs)
# Pushes to the branch that triggered this workflow run
# (github.ref_name), not a hardcoded branch name. This allows
# the workflow to be tested on feature/audit branches without
# accidentally writing metadata back to main.
# ──────────────────────────────────────────────────────────
- name: Commit and Push Metadata
if: always()
Expand All @@ -700,13 +706,13 @@ jobs:
# Rebase on any concurrent commits pushed while this job was running.
# The concurrency group (cancel-in-progress: true) prevents two jobs
# from running simultaneously, but a Renovate automerge or other
# automation could push to main between our checkout and this push.
git pull --rebase origin main || {
echo "ERROR: git rebase failed — likely a merge conflict with concurrent main changes." >&2
# automation could push to the branch between our checkout and this push.
git pull --rebase origin "${{ github.ref_name }}" || {
echo "ERROR: git rebase failed — likely a merge conflict with concurrent branch changes." >&2
git rebase --abort 2>/dev/null || true
exit 1
}
Comment on lines +710 to 714
Copy link

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

github.ref_name can be a tag name when the workflow is run via workflow_dispatch on a tag. In that case git pull --rebase origin "${{ github.ref_name }}" will fail (no remote branch), and the subsequent push may create/overwrite an unintended branch named after the tag. Consider guarding this step to only run on branch refs (e.g., if: github.ref_type == 'branch' or startsWith(github.ref, 'refs/heads/')), and skip the commit/push on tag runs.

Copilot uses AI. Check for mistakes.
git push origin HEAD:main
git push origin "HEAD:${{ github.ref_name }}"

# ──────────────────────────────────────────────────────────
# STEP 13 — Create GitHub Release
Expand Down
Loading