By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description Copilot
This pull request updates GitHub Actions workflows to improve security, reliability, and supply-chain integrity by pinning all action dependencies to specific commit SHAs and enhancing job configurations. The CI/CD pipeline receives significant upgrades for container signing, mirroring, and artifact handling, while the linting and test workflows now use a dedicated runner and stricter permissions.
Security & Supply Chain Improvements
All workflow actions are now pinned to specific commit SHAs to mitigate supply-chain risks, replacing version tags with SHA references across all workflows (cicd.yml, linting.yml, test.yml, stale-bot.yml). [1][2][3][4]
CI/CD Pipeline Enhancements
Added detailed permissions, concurrency controls, and a job-level timeout to the cicd.yml workflow. The pipeline now supports building, publishing, mirroring, and dual-signing container images for both Docker Hub and GHCR, including artifact uploads and digest-based verification. [1][2]
Introduced steps to install skopeo, jq, and cosign for image mirroring and signing, with dual-signing (keyless and key-based) and verification for both registries.
Runner & Permissions Updates
All workflows (linting.yml, test.yml, cicd.yml) now run on the custom amd64-runner instead of ubuntu-latest, and include explicit permissions blocks to restrict access to only necessary scopes. [1][2][3][4][5]
Workflow Reliability
Added concurrency controls to the CI/CD workflow to prevent overlapping runs on tag pushes, and job-level timeouts to avoid stuck jobs.
Artifact & Secret Management
Improved documentation for required secrets and environment variables in the CI/CD workflow, and updated artifact upload steps to use pinned actions. [1][2]
How to test?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/pangolin/pull/1715
**Author:** [@marcschaeferger](https://github.com/marcschaeferger)
**Created:** 10/21/2025
**Status:** ✅ Merged
**Merged:** 10/21/2025
**Merged by:** [@oschwartz10612](https://github.com/oschwartz10612)
**Base:** `main` ← **Head:** `gh-action`
---
### 📝 Commits (5)
- [`0e39704`](https://github.com/fosrl/pangolin/commit/0e39704b3a1527df4b6dd20cd5c967c111622bae) ci(actions): pin action versions to commit SHAs for security
- [`07330e8`](https://github.com/fosrl/pangolin/commit/07330e84fb6262f0be8491a381d353509e272358) ci(actions): change runner from ubuntu-latest to amd64-runner
- [`bfb5b28`](https://github.com/fosrl/pangolin/commit/bfb5b2864d4ab838f18c0984c28fc2ef58314cdb) ci(actions): add permissions section to workflows
- [`bc43054`](https://github.com/fosrl/pangolin/commit/bc430546bcb9f2b20cc26ec828bdccd551ff0552) ci(actions): add GHCR mirroring and cosign signing for Docker images
- [`c87aa2e`](https://github.com/fosrl/pangolin/commit/c87aa2e5371427a2401cd1a069f64a8318bf748f) Merge branch 'fosrl:main' into gh-action
### 📊 Changes
**4 files changed** (+125 additions, -16 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/cicd.yml` (+110 -7)
📝 `.github/workflows/linting.yml` (+7 -4)
📝 `.github/workflows/stale-bot.yml` (+2 -2)
📝 `.github/workflows/test.yml` (+6 -3)
</details>
### 📄 Description
## Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Description Copilot
This pull request updates GitHub Actions workflows to improve security, reliability, and supply-chain integrity by pinning all action dependencies to specific commit SHAs and enhancing job configurations. The CI/CD pipeline receives significant upgrades for container signing, mirroring, and artifact handling, while the linting and test workflows now use a dedicated runner and stricter permissions.
**Security & Supply Chain Improvements**
* All workflow actions are now pinned to specific commit SHAs to mitigate supply-chain risks, replacing version tags with SHA references across all workflows (`cicd.yml`, `linting.yml`, `test.yml`, `stale-bot.yml`). [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[2]](diffhunk://#diff-717013d02a8afac81852f25ba8ecd3cc0ca53a7f1fe25bedebfd66d6f518d21cL18-R27) [[3]](diffhunk://#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88L11-R19) [[4]](diffhunk://#diff-7d98caa1d6d6648f3266503a806c5b7dc6214839a1a1fabd7dcaa5c54d72222eL17-R17)
**CI/CD Pipeline Enhancements**
* Added detailed permissions, concurrency controls, and a job-level timeout to the `cicd.yml` workflow. The pipeline now supports building, publishing, mirroring, and dual-signing container images for both Docker Hub and GHCR, including artifact uploads and digest-based verification. [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[2]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R93-R181)
* Introduced steps to install `skopeo`, `jq`, and `cosign` for image mirroring and signing, with dual-signing (keyless and key-based) and verification for both registries.
**Runner & Permissions Updates**
* All workflows (`linting.yml`, `test.yml`, `cicd.yml`) now run on the custom `amd64-runner` instead of `ubuntu-latest`, and include explicit permissions blocks to restrict access to only necessary scopes. [[1]](diffhunk://#diff-717013d02a8afac81852f25ba8ecd3cc0ca53a7f1fe25bedebfd66d6f518d21cL18-R27) [[2]](diffhunk://#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88L11-R19) [[3]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[4]](diffhunk://#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88R3-R5) [[5]](diffhunk://#diff-717013d02a8afac81852f25ba8ecd3cc0ca53a7f1fe25bedebfd66d6f518d21cR3-R5)
**Workflow Reliability**
* Added concurrency controls to the CI/CD workflow to prevent overlapping runs on tag pushes, and job-level timeouts to avoid stuck jobs.
**Artifact & Secret Management**
* Improved documentation for required secrets and environment variables in the CI/CD workflow, and updated artifact upload steps to use pinned actions. [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[2]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R93-R181)
## How to test?
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/pangolin/pull/1715
Author: @marcschaeferger
Created: 10/21/2025
Status: ✅ Merged
Merged: 10/21/2025
Merged by: @oschwartz10612
Base:
main← Head:gh-action📝 Commits (5)
0e39704ci(actions): pin action versions to commit SHAs for security07330e8ci(actions): change runner from ubuntu-latest to amd64-runnerbfb5b28ci(actions): add permissions section to workflowsbc43054ci(actions): add GHCR mirroring and cosign signing for Docker imagesc87aa2eMerge branch 'fosrl:main' into gh-action📊 Changes
4 files changed (+125 additions, -16 deletions)
View changed files
📝
.github/workflows/cicd.yml(+110 -7)📝
.github/workflows/linting.yml(+7 -4)📝
.github/workflows/stale-bot.yml(+2 -2)📝
.github/workflows/test.yml(+6 -3)📄 Description
Community Contribution License Agreement
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Description Copilot
This pull request updates GitHub Actions workflows to improve security, reliability, and supply-chain integrity by pinning all action dependencies to specific commit SHAs and enhancing job configurations. The CI/CD pipeline receives significant upgrades for container signing, mirroring, and artifact handling, while the linting and test workflows now use a dedicated runner and stricter permissions.
Security & Supply Chain Improvements
cicd.yml,linting.yml,test.yml,stale-bot.yml). [1] [2] [3] [4]CI/CD Pipeline Enhancements
cicd.ymlworkflow. The pipeline now supports building, publishing, mirroring, and dual-signing container images for both Docker Hub and GHCR, including artifact uploads and digest-based verification. [1] [2]skopeo,jq, andcosignfor image mirroring and signing, with dual-signing (keyless and key-based) and verification for both registries.Runner & Permissions Updates
linting.yml,test.yml,cicd.yml) now run on the customamd64-runnerinstead ofubuntu-latest, and include explicit permissions blocks to restrict access to only necessary scopes. [1] [2] [3] [4] [5]Workflow Reliability
Artifact & Secret Management
How to test?
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.