merge chore/enforcement-gate (07241fa262) #35

Merged

pipeline-bot merged 1 commit from chore/enforcement-gate into trunk 2026-07-13 08:59:26 +00:00

Conversation 0 Commits 1 Files changed 3 +133 -2

pipeline-bot commented 2026-07-13 08:59:23 +00:00

Collaborator

Copy link

No description provided.

pipeline-bot added 1 commit 2026-07-13 08:59:23 +00:00

feat(gate): AlmaLinux-everywhere linter + pin sysadmin nix base ... 07241fa262

scripts/lint-no-runtime-fetch.sh — the CI gate: (dockerfiles mode) every image
FROM is an almalinux:10@sha256 base or a documented carve-out (mc COPY stage,
sysadmin=nix, debian-repo-signer=debian, in-house codeberg.org/someara/* chains),
every external base digest-pinned; (steps mode, used by pipelines) no pipeline
step fetches a tool at run time. pipeline-build-images CI runs the dockerfiles
mode over images/ (fail -> no build -> no MANIFEST -> merge blocked).

Also pins the ONE external base that was drifting: sysadmin FROM nixos/nix:2.24.12
-> @sha256 (the linter caught it). sysadmin stays nix (deliberate exception);
this is just reproducibility hardening. VERSION bump for the release-build gate.

pipeline-bot merged commit eee786f902 into trunk 2026-07-13 08:59:26 +00:00

pipeline-bot deleted branch chore/enforcement-gate 2026-07-13 08:59:26 +00:00

pipeline-bot referenced this pull request from a commit 2026-07-13 08:59:28 +00:00

Merge pull request 'merge chore/enforcement-gate (07241fa2620c)' (#35) from chore/enforcement-gate into trunk

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

seanfarm/builder-images!35

No description provided.