[PR #166] [MERGED] Adding GHCR to CI/CD Release Workflow & further improvements #158

New Issue

GiteaMirror · 2025-11-19T07:15:19-06:00

GiteaMirror commented

2025-11-19 07:15:19 -06:00

📋 Pull Request Information

Original PR: https://github.com/fosrl/newt/pull/166
Author: @marcschaeferger
Created: 10/21/2025
Status: ✅ Merged
Merged: 10/21/2025
Merged by: @oschwartz10612

Base: main ← Head: gh-action

📝 Commits (3)

ec05686 ci(actions): pin action versions to commit SHAs for security
2a273dc ci(actions): add GHCR mirroring and cosign signing for Docker images
a1a3d63 ci(actions): change runner from ubuntu-latest to amd64-runner for CI/CD workflows

📊 Changes

2 files changed (+155 additions, -59 deletions)

View changed files

📝 .github/workflows/cicd.yml (+152 -56)
📝 .github/workflows/test.yml (+3 -3)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description Copilot

This pull request enhances the CI/CD pipeline and test workflow for improved security, reliability, and container image handling. The main changes include pinning all GitHub Actions to specific commit SHAs, adding multi-registry container image publishing and signing (including dual-signing with Cosign), and improving runner consistency.

CI/CD Workflow Improvements:

All GitHub Actions in .github/workflows/cicd.yml are now pinned to specific SHAs to reduce supply-chain risk. [1] [2]
The pipeline now builds and pushes Docker images to both Docker Hub and GHCR, then mirrors images between registries using skopeo.
Container images are dual-signed using Cosign (both keyless OIDC and key-based), and signatures are verified for both registries.
Added job-level timeout and concurrency controls to prevent stuck or overlapping runs.
Improved documentation and environment variable management for clarity and maintainability.

Test Workflow Improvements:

The test workflow now uses the same self-hosted amd64-runner as the CI/CD pipeline for consistency.
Actions in .github/workflows/test.yml are also pinned to specific SHAs.

How to test?

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/newt/pull/166 **Author:** [@marcschaeferger](https://github.com/marcschaeferger) **Created:** 10/21/2025 **Status:** ✅ Merged **Merged:** 10/21/2025 **Merged by:** [@oschwartz10612](https://github.com/oschwartz10612) **Base:** `main` ← **Head:** `gh-action` --- ### 📝 Commits (3) - [`ec05686`](https://github.com/fosrl/newt/commit/ec05686523cc8ef1344c6d575576ff69eb3b50e6) ci(actions): pin action versions to commit SHAs for security - [`2a273dc`](https://github.com/fosrl/newt/commit/2a273dc435fb08cf4ced903b9dbfd767c645b946) ci(actions): add GHCR mirroring and cosign signing for Docker images - [`a1a3d63`](https://github.com/fosrl/newt/commit/a1a3d63fcffbdf6c783edcf9cb53867154e0f3da) ci(actions): change runner from ubuntu-latest to amd64-runner for CI/CD workflows ### 📊 Changes **2 files changed** (+155 additions, -59 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/cicd.yml` (+152 -56) 📝 `.github/workflows/test.yml` (+3 -3) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Copilot This pull request enhances the CI/CD pipeline and test workflow for improved security, reliability, and container image handling. The main changes include pinning all GitHub Actions to specific commit SHAs, adding multi-registry container image publishing and signing (including dual-signing with Cosign), and improving runner consistency. **CI/CD Workflow Improvements:** * All GitHub Actions in `.github/workflows/cicd.yml` are now pinned to specific SHAs to reduce supply-chain risk. [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R59) [[2]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R72-R157) * The pipeline now builds and pushes Docker images to both Docker Hub and GHCR, then mirrors images between registries using `skopeo`. * Container images are dual-signed using Cosign (both keyless OIDC and key-based), and signatures are verified for both registries. * Added job-level timeout and concurrency controls to prevent stuck or overlapping runs. * Improved documentation and environment variable management for clarity and maintainability. **Test Workflow Improvements:** * The test workflow now uses the same self-hosted `amd64-runner` as the CI/CD pipeline for consistency. * Actions in `.github/workflows/test.yml` are also pinned to specific SHAs. ## How to test? --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-19 07:15:19 -06:00

GiteaMirror closed this issue

2025-11-19 07:15:19 -06:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/newt#158