chore(ci): pilot docker-image-ci gold-standard reusable#121
Open
CybotTM wants to merge 5 commits into
Open
Conversation
Replace the hand-rolled lint/build/security-scan jobs in ci.yml with a single call to the org meta-reusable netresearch/.github/.github/workflows/docker-image-ci.yml, composing Dockerfile+shell lint, YAML/compose lint, a validation-only image build with Trivy, secret scanning and dependency review. - Grants the full caller permission union the meta requires (contents/packages/security-events/id-token/attestations/actions/ pull-requests). - shell-scandirs=setup, lint-compose over docker-compose.yml, gitleaks with GITLEAKS_LICENSE forwarded. - Adds .hadolint.yaml to carry forward the previous DL3018 ignore. - Keeps the bespoke 'Test FTP Server' runtime job (not covered by the meta's container-structure-test smoke test). References @feat/docker-gold-standard; flip to @main once netresearch/.github#251 merges. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a .hadolint.yaml configuration file to ignore the DL3018 rule, which suppresses warnings regarding package version pinning for Alpine's apk add. There are no review comments, and I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Dependency ReviewThe following issues were found:
License Issues.github/workflows/ci.yml
OpenSSF Scorecard
Scanned Files
|
…main The meta pins its leaf reusables @main; lint-compose.yml is introduced by netresearch/.github#251 and is not yet on main. GitHub resolves reusable uses: refs at startup, so an active lint-compose job makes the whole run startup-fail. Keep it off until the leaf is on main. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Reverts the diagnostic toggle. The run startup-fails either way until netresearch/.github#251 merges (the meta references lint-compose.yml@main, a leaf that only exists on the feature branch, and GitHub resolves reusable uses: refs at startup regardless of the job's if:). Keep the intended config; flip @feat/docker-gold-standard -> @main once #251 merges. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
The docker-ci gold-standard lint-container job surfaced unquoted expansions in setup/docker-entrypoint.sh. Quote them; mark the intentional ;-split array (SC2206) and the sequential vsftpd.conf appends (SC2129) as deliberate. Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Pilots the gold-standard
docker-image-ci.ymlmeta-reusable fromnetresearch/.githubon this repo. Replaces the hand-rolledlint/build/security-scanjobs inci.ymlwith a single call site.The meta composes: Dockerfile lint (hadolint) + shellcheck, YAML lint,
compose config-validation, a validation-only image build (
push: false)with Trivy, secret scanning (gitleaks), and dependency review.
CI currently startup-fails ("This run likely failed because of a
workflow file issue", 0 jobs). Root cause is not this caller — it is the
meta's leaf pinning during the pre-merge window:
@main(org policy). Two files are introduced by#251 and are not on
mainyet: the meta itself (referenced here via@feat/docker-gold-standard, fine) andlint-compose.yml(referencedby the meta as
lint-compose.yml@main, unresolvable).uses:at workflow-compile/startup time,regardless of a job's
if:. Verified empirically: settinglint-compose: falsestill startup-fails, because the meta'slint-composejob referenceis resolved before its
if:is evaluated.new leaves on
main.Resolution: once #251 merges, flip
@feat/docker-gold-standard→@main;the run will then spin up jobs and exercise the repo (surfacing any
hadolint/shellcheck/yamllint/Trivy findings as normal).
Inputs
image-namedocker-ftp-serverdockerfile./Dockerfilelint-containertrueshell-scandirssetupsetup/docker-entrypoint.shlint-yamltruelint-markdownfalse.mdfiles (README is.rst)lint-composetrue(docker-compose.yml)enable-gitleakstrueGITLEAKS_LICENSEforwardedenable-codeql/enable-smoke-testfalseGrants the full caller permission union the meta requires
(
contents:read, packages:write, security-events:write, id-token:write, attestations:write, actions:read, pull-requests:write).Also
.hadolint.yamlcarrying forward the previous inlineignore: DL3018.uses container-structure-test, which does not replicate the vsftpd boot
check, so it is not subsumed.
docker-publish.yml(push/sign) anddependency-review.ymlare untouched.Note: the meta also runs dependency-review on PRs, so once unblocked there
will be two dependency-review checks (the standalone file + the meta's);
consider dropping the standalone
dependency-review.ymlas a follow-up.Ref
References the reusable at
@feat/docker-gold-standard; flip to@mainonce netresearch/.github#251 merges.