Repository navigation
ci(renovate): pin base images and GitHub Actions to digests - #3025
Conversation
Enable Renovate's dockerfile and github-actions managers with pinDigests so OpenSSF Scorecard Pinned-Dependencies (currently 1/10) can pass and supply-chain refs stay reproducible. PR #2849 SHA-pinned actions in 13 workflows, but the check also scores container base images -- 58 unpinned FROM lines across 27 distinct images -- and left build-main.yaml / release-e2e.yaml unpinned. Nothing kept the new action SHAs updated either, so they would silently stop receiving security patches. Enabling the managers lets Renovate open the initial pin PR (and pin the two missed workflows) and keep digests fresh thereafter. Digest-only refreshes and the initial pin are batched into a single weekly PR to avoid a trickle of rebuild-triggering PRs on the shared CI runner; real tag bumps stay individual for review. Also pin s3manager's floating tags (golang:1, alpine:latest) to concrete versions first, otherwise digest tracking churns endlessly. Assisted-By: Claude <[email protected]> Signed-off-by: Myasnikov Daniil <[email protected]>
github-actions
Bot
added
size/S
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the project's supply-chain security posture by configuring Renovate to automatically pin container base images and GitHub Actions to immutable digests. These changes are designed to improve the OpenSSF Scorecard Pinned-Dependencies score and ensure more reproducible builds. The configuration includes a batching strategy to reduce CI load, and specific Dockerfile updates were made to replace floating tags with concrete versions, facilitating better tracking. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
dosubot
Bot
added
the
area/ci
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughRenovate configuration is extended to manage ChangesRenovate Digest Pinning and Dockerfile Version Pinning
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Renovate configuration to manage and pin Dockerfile base images and GitHub Actions. It also updates the s3manager Dockerfile to use specific versions of Go and Alpine. However, the specified versions (Go 1.26 and Alpine 3.24) do not exist yet and will cause the build to fail. It is recommended to use existing stable versions such as Go 1.23 and Alpine 3.21.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| # Source: https://github.com/cloudlena/s3manager/blob/main/Dockerfile | ||
|
|
||
| FROM docker.io/library/golang:1 AS builder | ||
| FROM docker.io/library/golang:1.26 AS builder |
There was a problem hiding this comment.
The Go version 1.26 does not exist yet (the latest stable releases are 1.23 and 1.24). Using a non-existent tag will cause the Docker build to fail. Please use a valid, existing Go version.
FROM docker.io/library/golang:1.23 AS builder
There was a problem hiding this comment.
golang:1.26 does exist — it was released in February 2026 and is already the standard builder base across this repository: cozystack-api, kamaji, backup-controller, token-proxy and ~10 other first-party images build on golang:1.26 / golang:1.26-alpine in CI. Pinning s3manager to 1.23 would diverge from that baseline, so keeping 1.26.
| RUN GOOS=$TARGETOS GOARCH=$TARGETARCH CGO_ENABLED=0 go build -ldflags="-s -w" -a -installsuffix cgo -o bin/s3manager | ||
|
|
||
| FROM docker.io/library/alpine:latest | ||
| FROM docker.io/library/alpine:3.24 |
There was a problem hiding this comment.
The Alpine version 3.24 does not exist yet (the latest stable release is 3.21). Using a non-existent tag will cause the Docker build to fail. Please use a valid, existing Alpine version.
FROM docker.io/library/alpine:3.21
There was a problem hiding this comment.
alpine:3.24 does exist (last pushed 2026-06-16) and is the current first-party runtime baseline — #3009 deliberately moved the runtime bases to alpine:3.24 (cozystack-operator, migrations, mariadb-backup, etc. all use it). Reverting s3manager to 3.21 would diverge from that, so keeping 3.24.
IvanHunters
left a comment
IvanHunters
left a comment
There was a problem hiding this comment.
Verdict
LGTM
The Renovate configuration is syntactically valid, the packageRule semantics correctly produce the claimed behavior (initial pin + weekly digest grouping for dockerfile + github-actions, with major/minor/patch tag bumps intentionally left out of the group for individual review), the chosen base tags (golang:1.26, alpine:3.24) are both current upstream-stable as of today, and the Dockerfile tag-hygiene change is consistent with the cluster-wide Alpine 3.24 baseline merged earlier in bebf4db0. All five PR-body claims verified against the diff and the renovate.json final state. Conventional Commits + DCO signoff + release-note fenced block all present.
Recommended follow-ups
- Two Dockerfiles still use a fully tagless base (
FROM alpine AS source) —packages/system/keycloak-operator/images/keycloak-operator/Dockerfile:3andpackages/system/objectstorage-controller/images/objectstorage/Dockerfile:3. Renovate'spinDigestswill resolve those toalpine:latest@sha256:...on the first run, which works but is fragile: the next Alpinelatestretag will produce an opaque digest bump in the grouped PR with no human-readable tag delta. Worth a tiny separate PR to set them toalpine:3.24before Renovate's first sweep. packages/system/linstor/images/linstor-csi/Dockerfile:26(debian:trixie-slim),packages/system/linstor/images/piraeus-server/Dockerfile:6(debian:bookworm), andpackages/system/multus/images/multus-cni/Dockerfile:18(debian:stable-slim) use Debian codename-only tags.debian:stable-slimin particular is roughly equivalent to:latestand will keep producing weekly digest churn whenever the upstream stable point release ships. Consider pinning to a concretedebian:12-slim/debian:13-slimin a follow-up.- After Renovate's first grouped pin PR lands, run the OpenSSF Scorecard check once to confirm the Pinned-Dependencies score actually moves to the predicted 7-8 range — the PR's projected outcome is a falsifiable claim worth verifying.
Aleksei Sviridkin (lexfrei)
left a comment
Aleksei Sviridkin (lexfrei)
left a comment
There was a problem hiding this comment.
LGTM
Business context: enables Renovate's dockerfile and github-actions managers with digest pinning so OpenSSF Scorecard's Pinned-Dependencies check is no longer dominated by unpinned base images and action refs.
Blockers: none.
I confirmed the config is valid and achieves the stated pinning.
- The config parses and Renovate extracts both new managers end to end. A local dry run reports
dockerfile(36 files, 59 deps) andgithub-actions(17 files, 91 deps) alongside the existinggomod. Manager names, update types (digest,pinDigest), and fields (pinDigests,groupName,schedule) are all valid. Evidence:.github/renovate.json:7,28-36. - The two new rules combine without conflict: rule 3 sets
pinDigests: true, rule 4 addsgroupNameplus a weeklyschedulescoped todigest/pinDigestonly. No shared field is overwritten, so digest refreshes are both pinned and batched into one weekly PR while real tag bumps stay individual. Evidence:.github/renovate.json:28-36. - The
dockerfilemanager covers every build file. There are noContainerfiles that its default file matching would skip. Evidence: the repo has 36Dockerfiles and 0Containerfiles.
On the concern that golang:1.26 / alpine:3.24 do not yet exist: disproven. Both are already the repo-wide baseline, so the s3manager change aligns it with images already shipping. Evidence: golang:1.26 is in 14 Dockerfiles (e.g. packages/system/cozystack-api/images/cozystack-api/Dockerfile:1) and alpine:3.24 is in 7 (e.g. packages/core/installer/images/cozystack-operator/Dockerfile:20).
Non-blocking
- Enabling these managers also surfaces individual tag-bump PRs (major/minor/patch) on top of the one-time initial digest pin across ~59 image refs and ~91 action refs. This is intended and throttled by
prConcurrentLimit: 5, thedo-not-merge/holdlabel, andautomerge: false, but expect an initial PR burst before steady state. Evidence:.github/renovate.json:9-12,33-36.
3 participants
What this PR does
Raises OpenSSF Scorecard Pinned-Dependencies (currently 1/10) by having Renovate manage and pin container base images and GitHub Actions to immutable digests.
PR #2849 SHA-pinned actions in 13 workflows, but the Scorecard check also scores container base images — 58 unpinned
FROMlines across 27 distinct images — which dominate the score and keep it at 1/10. #2849 also leftbuild-main.yamlandrelease-e2e.yamlactions unpinned, and nothing in the Renovate config kept the newly-added action SHAs updated (they were set to rot).Changes
.github/renovate.jsondockerfileandgithub-actionstoenabledManagers(wasgomod-only).pinDigests: truefor both managers — Renovate opens the initial "pin to@sha256:" PR (including the two workflows ci: harden workflow token permissions and pin actions by SHA #2849 missed) and keeps digests fresh thereafter.matchUpdateTypes: ["digest", "pinDigest"], scheduled Monday). Frequently-rebuilt bases (alpine, debian, golang, distroless) would otherwise trickle in one rebuild-triggering PR each and load the shared CI runner. Real tag bumps (major/minor/patch) are intentionally excluded from the group so they get individual review.do-not-merge/holdlabel +automerge: falseare unchanged, so every PR still requires a manual merge.packages/system/bucket/images/s3manager/Dockerfile— pin floating tags to concrete versions so digest tracking doesn't churn endlessly:golang:1→golang:1.26,alpine:latest→alpine:3.24.Notes
downloadThenRun/ pip / npm items cap it below 10.Release note
Summary by CodeRabbit