claude-bot
2feec4b193
ci/woodpecker/push/build-ci-images Pipeline was successful
Addresses #209. All four ci/images/*/Containerfile FROM lines were tag-pinned only (alpine:3.21, node:22-alpine), letting the base silently change between builds. Pin each to its current manifest-list digest. ci/images/k8s/Containerfile downloaded talosctl, kubectl, and velero via curl with no integrity check, and installed flux via `curl | bash` (itself an unpinned, unverified fetch-and-execute). Replace the flux install with a pinned-version tarball download verified against its published sha256 checksum, same as talosctl/kubectl/velero now are. kubectl's version was also resolved dynamically from dl.k8s.io's stable.txt at build time instead of being pinned; add KUBECTL_VERSION. ci/images/tofu/Containerfile's tofu.zip download gets the same sha256 verification. ci/images/claude/Containerfile's CLAUDE_CODE_VERSION defaulted to `latest` and was never overridden by build-ci-images.yml, so the image holding repo/issue-write tokens floated to whatever npm resolved at build time. Pin it to the current release (2.1.209). Checksums and digests verified against the respective registries/release APIs at fix time (2026-07-14). Co-Authored-By: Claude Bot <claude-bot@renner.uno>
45 lines
1.9 KiB
Docker
45 lines
1.9 KiB
Docker
FROM alpine:3.21@sha256:48b0309ca019d89d40f670aa1bc06e426dc0931948452e8491e3d65087abc07d
|
|
|
|
ARG TALOS_VERSION=v1.12.6
|
|
ARG VELERO_VERSION=v1.16.0
|
|
ARG KUBECTL_VERSION=v1.36.2
|
|
ARG FLUX_VERSION=2.9.2
|
|
|
|
RUN apk add --no-cache \
|
|
aws-cli \
|
|
bash \
|
|
bind-tools \
|
|
ca-certificates \
|
|
curl \
|
|
git \
|
|
openssh-client \
|
|
openssl \
|
|
sops
|
|
|
|
RUN curl -sfL -o /usr/local/bin/talosctl \
|
|
"https://github.com/siderolabs/talos/releases/download/${TALOS_VERSION}/talosctl-linux-amd64" \
|
|
&& echo "4c41a3b10b075292e64b182283d558e9d8e935f43239de1ed4e4b14359593efb /usr/local/bin/talosctl" | sha256sum -c - \
|
|
&& chmod +x /usr/local/bin/talosctl
|
|
|
|
RUN curl -sfL -o /usr/local/bin/kubectl \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
|
|
&& curl -sfL -o /tmp/kubectl.sha256 \
|
|
"https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256" \
|
|
&& echo "$(cat /tmp/kubectl.sha256) /usr/local/bin/kubectl" | sha256sum -c - \
|
|
&& rm -f /tmp/kubectl.sha256 \
|
|
&& chmod +x /usr/local/bin/kubectl
|
|
|
|
RUN curl -sfL -o /tmp/flux.tar.gz \
|
|
"https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
|
|
&& echo "4092b367fd060097976fb7261601f79420ecf7266328417dfd8dfee27de0e6a3 /tmp/flux.tar.gz" | sha256sum -c - \
|
|
&& tar -xzf /tmp/flux.tar.gz -C /usr/local/bin flux \
|
|
&& chmod +x /usr/local/bin/flux \
|
|
&& rm -f /tmp/flux.tar.gz
|
|
|
|
RUN curl -sfL -o /tmp/velero.tar.gz \
|
|
"https://github.com/velero-io/velero/releases/download/${VELERO_VERSION}/velero-${VELERO_VERSION}-linux-amd64.tar.gz" \
|
|
&& echo "b228154536d377cd6ddc271f5d6a622f1167d911ae555dd7382181d0840f6d05 /tmp/velero.tar.gz" | sha256sum -c - \
|
|
&& tar -xz -C /tmp -f /tmp/velero.tar.gz \
|
|
&& install "/tmp/velero-${VELERO_VERSION}-linux-amd64/velero" /usr/local/bin/velero \
|
|
&& rm -rf "/tmp/velero-${VELERO_VERSION}-linux-amd64" /tmp/velero.tar.gz
|