noel/act-node-docker
Watch
1
0
Fork
You've already forked act-node-docker
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ci: preload locked Cloudflare provider in runner image #16

Merged
noel merged 1 commit from ci/r2-provider-2047 into main 2026-09-10 12:48:14 +00:00
Conversation 0 Commits 1 Files changed 3 +230
noel commented 2026-09-10 12:46:45 +00:00
Owner

The native R2 lifecycle tests cannot install their locked Cloudflare provider on restricted Forgejo runners. Add the Cloudflare5.24.0 linux/amd64 archive as one read-only layer over the existing approved runner digest, so OpenTofu can install it from a checksum-verified filesystem mirror without registry access.

The parent toolchain and its16-input recipe are unchanged. The derivative verifies the input and installed SHA256, requires the exact source commit, and records source/base OCI provenance. Infra owns the existing separated prefetch/publisher transaction and will pin the result only after actual image qualification. This source PR does not publish or change a running image.

Validation:9 focused tests passed, covering8 synthetic installation runs and8 source-boundary mutation cases. Bash syntax, ShellCheck, whitespace and unchanged-parent-source checks passed. No image build or real provider execution occurred locally. Program: codewire/codewire#2047.

The native R2 lifecycle tests cannot install their locked Cloudflare provider on restricted Forgejo runners. Add the Cloudflare5.24.0 linux/amd64 archive as one read-only layer over the existing approved runner digest, so OpenTofu can install it from a checksum-verified filesystem mirror without registry access. The parent toolchain and its16-input recipe are unchanged. The derivative verifies the input and installed SHA256, requires the exact source commit, and records source/base OCI provenance. Infra owns the existing separated prefetch/publisher transaction and will pin the result only after actual image qualification. This source PR does not publish or change a running image. Validation:9 focused tests passed, covering8 synthetic installation runs and8 source-boundary mutation cases. Bash syntax, ShellCheck, whitespace and unchanged-parent-source checks passed. No image build or real provider execution occurred locally. Program: https://git.noel.sh/codewire/codewire/issues/2047. 
Signed-off-by: Noel Jackson <n@noeljackson.com>
noel merged commit 1aec067045 into main 2026-09-10 12:48:14 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
noel/act-node-docker!16
No description provided.