konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 2 Packages Projects Releases 1 Wiki Activity

fix(ci): pin base image digests, verify tool checksums, pin claude-code version #233

Merged
k.renner merged 1 commits from fix/issue-209 into master 2026-07-14 10:54:49 +00:00
Conversation 0 Commits 1 Files Changed 4
+25 -11
4 changed files with 25 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ci/images/ansible/Containerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM alpine:3.21
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
RUN apk add --no-cache \
ansible \
ci/images/claude/Containerfile
+2 -2
View File
@@ -1,6 +1,6 @@
FROM node:22-alpine
FROM node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2
ARG CLAUDE_CODE_VERSION=latest
ARG CLAUDE_CODE_VERSION=2.1.209
RUN apk add --no-cache \
bash \
ci/images/k8s/Containerfile
+20 -7
View File
@@ -1,7 +1,9 @@
FROM alpine:3.21
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
ARG TALOS_VERSION=v1.12.6
ARG VELERO_VERSION=v1.16.0
ARG KUBECTL_VERSION=v1.36.2
ARG FLUX_VERSION=2.9.2
RUN apk add --no-cache \
aws-cli \
@@ -16,16 +18,27 @@ RUN apk add --no-cache \
RUN curl -sfL -o /usr/local/bin/talosctl \
"https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/talosctl-linux-amd64" \
&& echo "4c41a3b10b075292e64b182283d558e9d8e935f43239de1ed4e4b14359593efb /usr/local/bin/talosctl" | sha256sum -c - \
&& chmod +x /usr/local/bin/talosctl
RUN KUBECTL_VERSION="$(curl -sfL https://dl.k8s.io/release/stable.txt)" \
&& curl -sfL -o /usr/local/bin/kubectl \
RUN curl -sfL -o /usr/local/bin/kubectl \
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
&& curl -sfL -o /tmp/kubectl.sha256 \
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
&& echo "$(cat /tmp/kubectl.sha256) /usr/local/bin/kubectl" | sha256sum -c - \
&& rm -f /tmp/kubectl.sha256 \
&& chmod +x /usr/local/bin/kubectl
RUN curl -sfL https://fluxcd.io/install.sh | bash
RUN curl -sfL -o /tmp/flux.tar.gz \
"https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
&& echo "4092b367fd060097976fb7261601f79420ecf7266328417dfd8dfee27de0e6a3 /tmp/flux.tar.gz" | sha256sum -c - \
&& tar -xzf /tmp/flux.tar.gz -C /usr/local/bin flux \
&& chmod +x /usr/local/bin/flux \
&& rm -f /tmp/flux.tar.gz
RUN curl -sfL "https://github.com/vmware-tanzu/velero/releases/download/${VELERO_VERSION}/velero-${VELERO_VERSION}-linux-amd64.tar.gz" \
| tar -xz -C /tmp \
RUN curl -sfL -o /tmp/velero.tar.gz \
"https://github.com/velero-io/velero/releases/download/${VELERO_VERSION}/velero-${VELERO_VERSION}-linux-amd64.tar.gz" \
&& echo "b228154536d377cd6ddc271f5d6a622f1167d911ae555dd7382181d0840f6d05 /tmp/velero.tar.gz" | sha256sum -c - \
&& tar -xz -C /tmp -f /tmp/velero.tar.gz \
&& install "/tmp/velero-${VELERO_VERSION}-linux-amd64/velero" /usr/local/bin/velero \
&& rm -rf "/tmp/velero-${VELERO_VERSION}-linux-amd64"
&& rm -rf "/tmp/velero-${VELERO_VERSION}-linux-amd64" /tmp/velero.tar.gz
ci/images/tofu/Containerfile
+2 -1
View File
@@ -1,4 +1,4 @@
FROM alpine:3.21
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
ARG TOFU_VERSION=1.11.0
@@ -19,6 +19,7 @@ RUN apk add --no-cache \
RUN curl -sfL -o /tmp/tofu.zip \
"https://github.com/opentofu/opentofu/releases/download/v${TOFU_VERSION}/tofu_${TOFU_VERSION}_linux_amd64.zip" \
&& echo "c425c2080e3f204a1fe094356777535a34c4bc9fdbca4eccb74cdd25c1ae8a94 /tmp/tofu.zip" | sha256sum -c - \
&& unzip -q /tmp/tofu.zip -d /tmp/tofu \
&& install /tmp/tofu/tofu /usr/local/bin/tofu \
&& rm -rf /tmp/tofu /tmp/tofu.zip