noel/act-node-docker
Watch
1
0
Fork
You've already forked act-node-docker
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ci: seal Go advisory database in runner image #17

Merged
noel merged 1 commit from fix/runner-go-osv-984 into main 2026-09-18 01:00:11 +00:00
Conversation 0 Commits 1 Files changed 5 +310
noel commented 2026-09-18 00:58:59 +00:00
Owner

Adds one checksum- and generation-pinned Go OSV snapshot over the existing accepted runner digest. Preserves parent binaries, PyPI database and Cloudflare provider. No policy bypass, publication, or consumer rollout in this source PR; Infra Program #984 owns the separately approved Flux publication and offline image qualification. Local proof: 4 source tests including 12 rejected mutations and 11 synthetic installations; real OSV 2.4.0 offline vulnerable/fixed/missing/corrupt cases exit 1/0/127/127; existing R2 source tests 9 pass; redacted tree/history Gitleaks clean (43 commits); diff check clean. Independent security review found no blocking source issue. Acceptance after publication must use normal sealed-cache discovery and both consumed supplychain revisions in a non-root deny-all-egress pod before digest adoption.

Adds one checksum- and generation-pinned Go OSV snapshot over the existing accepted runner digest. Preserves parent binaries, PyPI database and Cloudflare provider. No policy bypass, publication, or consumer rollout in this source PR; Infra Program #984 owns the separately approved Flux publication and offline image qualification. Local proof: 4 source tests including 12 rejected mutations and 11 synthetic installations; real OSV 2.4.0 offline vulnerable/fixed/missing/corrupt cases exit 1/0/127/127; existing R2 source tests 9 pass; redacted tree/history Gitleaks clean (43 commits); diff check clean. Independent security review found no blocking source issue. Acceptance after publication must use normal sealed-cache discovery and both consumed supplychain revisions in a non-root deny-all-egress pod before digest adoption.
noel merged commit 92fd9684ad into main 2026-09-18 01:00:11 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
noel/act-node-docker!17
No description provided.