veilor-org/veilor-os
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 1

ci: pin fedora:43 base image to digest

Browse source 
Pin registry.fedoraproject.org/fedora:43 to its current manifest
digest so a malicious or accidental tag-rewrite upstream cannot
silently change the base layer of every CI build. Digest was
captured via `skopeo inspect --raw` on 2026-05-06. Refresh
procedure documented inline.
This commit is contained in:
veilor-org 2026-05-06 10:41:10 +01:00 committed by s8n
parent e93ef644e1
commit 9158532c9d
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/build-iso.yml vendored
View file

@ -48,7 +48,9 @@ jobs:
# SHA pinning in a follow-up sweep.
uses: addnab/docker-run-action@v3
with:
image: registry.fedoraproject.org/fedora:43
# Pinned to digest from `skopeo inspect --raw` on 2026-05-06.
# Refresh by re-running skopeo against fedora:43 and bumping.
image: registry.fedoraproject.org/fedora:43@sha256:72e874e771b953c6357c7a5823c6fc1e3e3253b90121e795febe01380e32269b
options: |
--privileged
-v ${{ github.workspace }}:/work