By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description Copilot
This pull request enhances the CI/CD pipeline and test workflow for improved security, reliability, and container image handling. The main changes include pinning all GitHub Actions to specific commit SHAs, adding multi-registry container image publishing and signing (including dual-signing with Cosign), and improving runner consistency.
CI/CD Workflow Improvements:
All GitHub Actions in .github/workflows/cicd.yml are now pinned to specific SHAs to reduce supply-chain risk. [1][2]
The pipeline now builds and pushes Docker images to both Docker Hub and GHCR, then mirrors images between registries using skopeo.
Container images are dual-signed using Cosign (both keyless OIDC and key-based), and signatures are verified for both registries.
Added job-level timeout and concurrency controls to prevent stuck or overlapping runs.
Improved documentation and environment variable management for clarity and maintainability.
Test Workflow Improvements:
The test workflow now uses the same self-hosted amd64-runner as the CI/CD pipeline for consistency.
Actions in .github/workflows/test.yml are also pinned to specific SHAs.
How to test?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/newt/pull/166
**Author:** [@marcschaeferger](https://github.com/marcschaeferger)
**Created:** 10/21/2025
**Status:** ✅ Merged
**Merged:** 10/21/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `main` ← **Head:** `gh-action`
---
### 📝 Commits (3)
- [`ec05686`](https://github.com/fosrl/newt/commit/ec05686523cc8ef1344c6d575576ff69eb3b50e6) ci(actions): pin action versions to commit SHAs for security
- [`2a273dc`](https://github.com/fosrl/newt/commit/2a273dc435fb08cf4ced903b9dbfd767c645b946) ci(actions): add GHCR mirroring and cosign signing for Docker images
- [`a1a3d63`](https://github.com/fosrl/newt/commit/a1a3d63fcffbdf6c783edcf9cb53867154e0f3da) ci(actions): change runner from ubuntu-latest to amd64-runner for CI/CD workflows
### 📊 Changes
**2 files changed** (+155 additions, -59 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/cicd.yml` (+152 -56)
📝 `.github/workflows/test.yml` (+3 -3)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description Copilot
This pull request enhances the CI/CD pipeline and test workflow for improved security, reliability, and container image handling. The main changes include pinning all GitHub Actions to specific commit SHAs, adding multi-registry container image publishing and signing (including dual-signing with Cosign), and improving runner consistency.
**CI/CD Workflow Improvements:**
* All GitHub Actions in `.github/workflows/cicd.yml` are now pinned to specific SHAs to reduce supply-chain risk. [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R59) [[2]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R72-R157)
* The pipeline now builds and pushes Docker images to both Docker Hub and GHCR, then mirrors images between registries using `skopeo`.
* Container images are dual-signed using Cosign (both keyless OIDC and key-based), and signatures are verified for both registries.
* Added job-level timeout and concurrency controls to prevent stuck or overlapping runs.
* Improved documentation and environment variable management for clarity and maintainability.
**Test Workflow Improvements:**
* The test workflow now uses the same self-hosted `amd64-runner` as the CI/CD pipeline for consistency.
* Actions in `.github/workflows/test.yml` are also pinned to specific SHAs.
## How to test?
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/newt/pull/166
Author: @marcschaeferger
Created: 10/21/2025
Status: ✅ Merged
Merged: 10/21/2025
Merged by: @oschwartz10612
Base:
main← Head:gh-action📝 Commits (3)
ec05686ci(actions): pin action versions to commit SHAs for security2a273dcci(actions): add GHCR mirroring and cosign signing for Docker imagesa1a3d63ci(actions): change runner from ubuntu-latest to amd64-runner for CI/CD workflows📊 Changes
2 files changed (+155 additions, -59 deletions)
View changed files
📝
.github/workflows/cicd.yml(+152 -56)📝
.github/workflows/test.yml(+3 -3)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description Copilot
This pull request enhances the CI/CD pipeline and test workflow for improved security, reliability, and container image handling. The main changes include pinning all GitHub Actions to specific commit SHAs, adding multi-registry container image publishing and signing (including dual-signing with Cosign), and improving runner consistency.
CI/CD Workflow Improvements:
.github/workflows/cicd.ymlare now pinned to specific SHAs to reduce supply-chain risk. [1] [2]skopeo.Test Workflow Improvements:
amd64-runneras the CI/CD pipeline for consistency..github/workflows/test.ymlare also pinned to specific SHAs.How to test?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.