Repository navigation
ci: re-pin git-your-ship-together to v1.15.0 - #273
Merged
Merged
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
There was a problem hiding this comment.
🟢 Approval recommended
All GYST references consistently use the valid, signed v1.15.0 commit and retain compatible caller configuration.
0 open findings
What changed in this PR
Re-pins all reusable GYST workflows to the verified v1.15.0 commit.
Changes:
- Updates all five workflow references to
804400181a9d3e2f78dfcda5161e2bd960bc011a. - Updates version comments to v1.15.0.
| File | Description |
|---|---|
.github/workflows/verify.yml |
Updates publication verification workflow. |
.github/workflows/security.yml |
Updates security workflow. |
.github/workflows/release.yml |
Updates container release workflow. |
.github/workflows/dependabot-auto-merge.yml |
Updates Dependabot auto-merge workflow. |
.github/workflows/ci.yml |
Updates Python CI workflow. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
v1.15.0's container release lints the Dockerfile by default and fails on warnings (DL3008). Opt out until the Dockerfile is clean. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Remove hadolint-continue-on-error. Pin apt/pip versions, use exec-form HEALTHCHECK/CMD, and add a dedicated non-root user (numeric USER) whose UID matches the existing volume owners where there are any. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… in CI The release Trivy scan failed on a fixed HIGH finding (libpcre2) because the image never ran apt-get upgrade. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Debian removes superseded package versions, so exact apt pins break the build at every security update, and they contradict apt-get upgrade. The base image stays pinned by digest. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-pins every git-your-ship-together workflow call to v1.15.0 (804400181a9d3e2f78dfcda5161e2bd960bc011a), now with no opt-outs.
What changed
hadolint-continue-on-error; the release job runs GYST's default Dockerfile lint (hadolint 2.15.1,--failure-threshold warning) and the defaultrequire-non-rootcheck.# hadolint ignore=DL3008and the reason beside it (base image is pinned by digest; Debian removes superseded package versions, so exact apt pins would break the build at every security update).WORKDIR /tmp/sqliteinstead ofcd; the build tree is still deleted in the same layer.make -j"$(nproc)"is quoted. DL3047:wget --progress=dot:giga.streamdaemonuser and group (UID/GID 1000) withUSER 1000:1000;/appis owned by it.apt-get upgrade -yto the apt layer.ci.ymlnow setsextra-allowed-endpoints: www.sqlite.org:443(asrelease.ymlalready did), because the SQLite source download is blocked in the CI container build underegress-policy: block.DL3008on the apt install layers, with the reason stated. Otherwise the Dockerfile is clean even at hadolint'sinfothreshold.id -uprints the non-root UID, and the CI import check passes.Deploy note
None. The compose deployment mounts only
messages.txtandend_messages.txt, both read-only and world-readable, so there is no writable mount to match. UID 1000 is the conventional first unprivileged account.🤖 Generated with Claude Code