ci: yq is fetched from the floating latest release and installed as root in four privileged workflows

Summary

Four workflows install yq at run time with sudo curl -sSL -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 — promote-rc.yaml, pull-requests-release.yaml, nightly.yaml, tags.yaml. The binary is fetched from the floating latest release, with no version pin and no checksum, and installed as root. Every copy is the same block, so this looks like one pattern propagated by copying.

Why it matters

These are exactly the privileged workflows: promotion, release finalization, nightly image mirroring, tag publishing. A compromised or merely broken latest release lands directly in the jobs that hold registry and release credentials, and a behavior change in a new yq major (which has happened before in yq's history) changes what gets promoted without any diff in this repository. The rest of the toolchain in these jobs is pinned; yq is the exception.

Fix shape

Pin a version and verify a checksum in one shared place, in the same spirit as the existing shared image-refs enumeration: either a small hack/ install script the four workflows call, or a composite action. Bumping the pin then becomes an ordinary reviewable diff.

Same pattern, another tool: the flux install in the build workflows.

Set up build toolchain installs flux from the upstream bootstrap with no version pin and no retry:

if ! command -v flux >/dev/null; then
  install_script="$(mktemp)"
  curl -fsSL https://fluxcd.io/install.sh -o "$install_script"
  sudo bash "$install_script"
  rm -f "$install_script"
fi

With no FLUX_VERSION in the environment, install.sh resolves the floating latest and fetches flux_<latest>_checksums.txt in a single unauthenticated curl -f. This copy of the block lives in pull-requests.yaml, build-release.yaml, build-main.yaml and tags.yaml.

It already broke a build. On #4429 the Build packages/system/backupstrategy-controller job failed in Set up build toolchain:

[INFO]  Using 2.9.5 as release
[INFO]  Downloading hash https://github.com/fluxcd/flux2/releases/download/v2.9.5/flux_2.9.5_checksums.txt
##[error]Process completed with exit code 22.

curl -f exit 22 means the server returned HTTP >= 400 on that request. The asset is fine (it serves 200 now, v2.9.5 is a real release) and only that one matrix job failed while every sibling running the same step passed, so this was a transient 4xx on the release CDN, not a broken release and not the PR (which does not touch backupstrategy-controller). Unpinned latest plus no retry turns a momentary GitHub blip into a red build.

The fix pattern already exists one step above it: in the same pull-requests.yaml, Set up promotion toolchain pins FLUX_VERSION: "2.8.6" and installs only when that exact version is absent. The build-toolchain steps are the exception, the same way yq is. Folding flux into the shared pinned install this issue proposes, or at minimum passing FLUX_VERSION and adding curl --retry, would close both.

ci(workflows): pin flux version in build toolchain steps

ci(workflows): pin flux version across CI toolchain steps (#4442)

ci(workflows): pin flux, yq and helm-unittest installs (cozystack#4645)

Navigation Menu

Repository navigation

ci: yq is fetched from the floating latest release and installed as root in four privileged workflows #3640

Summary

Why it matters

Fix shape

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

ci: yq is fetched from the floating latest release and installed as root in four privileged workflows #3640

Description

Summary

Why it matters

Fix shape

Activity

IvanHunters commented on Sep 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions