webgrip/homelab-cluster
5
0
Fork 0
Code Issues 2 Pull requests 18 Projects Releases Packages Wiki Activity Actions

fix(runners): pin runner images as tag@digest on current releases #443

Open
ryangr0 wants to merge 1 commit from ryangr0/fix/runner-image-pins into main AGit
pull from: ryangr0/fix/runner-image-pins
merge into: webgrip:main
Conversation 0 Commits 1 Files changed 5 +6 -6
ryangr0 commented 2026-07-27 09:22:50 +00:00
Owner
Copy link

Replaces the bare (pre-1.1.0) ci-runner digest in both ARC scale sets and the Forgejo runner ScaledJob with ci-runner:1.2.0@sha256:ee1401d0..., and converges agent-runner on 1.0.3@sha256:53a1f11b... (forgejo-agent-runner ScaledJob was 1.0.0, ploeg HelmRelease was 1.0.2). Digests read from the release runs' cosign logs. IMPORTANT: ci-runner 1.2.0's signing is still pending — re-run the failed Sign & Attest job on infrastructure run 151 (the OpenBao event_name bound-claim it died on is fixed) so image-verify-harbor-audit sees a signature after Flux syncs this. Generated with Claude Code.

Replaces the bare (pre-1.1.0) ci-runner digest in both ARC scale sets and the Forgejo runner ScaledJob with ci-runner:1.2.0@sha256:ee1401d0..., and converges agent-runner on 1.0.3@sha256:53a1f11b... (forgejo-agent-runner ScaledJob was 1.0.0, ploeg HelmRelease was 1.0.2). Digests read from the release runs' cosign logs. IMPORTANT: ci-runner 1.2.0's signing is still pending — re-run the failed Sign & Attest job on infrastructure run 151 (the OpenBao event_name bound-claim it died on is fixed) so image-verify-harbor-audit sees a signature after Flux syncs this. Generated with Claude Code.
fix(runners): pin runner images as tag@digest on current releases
All checks were successful
e2e / Kyverno Chainsaw (KinD) (pull_request) Successful in 16s
Details
e2e / Validate Renovate config (pull_request) Successful in 1m0s
Details
e2e / Lint & static validation (pull_request) Successful in 1m0s
Details
e2e / Flux-local render (pull_request) Successful in 1m29s
Details
bb3ade7b32 
ci-runner was pinned by a BARE digest (dee7dee6 — older than 1.1.0, whose digest is
14967fe1) in both ARC scale sets and the Forgejo runner ScaledJob: unreadable, and
unbumpable by Renovate. Re-pin as tag@digest on 1.2.0 (digest ee1401d0, read from release
run 151's cosign log). agent-runner converges on 1.0.3 (digest 53a1f11b, run 157's cosign
log) in the forgejo-agent-runner ScaledJob (was 1.0.0) and the ploeg HelmRelease (was 1.0.2).

NB: ci-runner 1.2.0 is distributed but its Sign & Attest job failed on the OpenBao
event_name claim (fixed since) — re-run the failed job on infrastructure run 151 before or
right after this syncs, so image-verify-harbor-audit sees a signature.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
All checks were successful
e2e / Kyverno Chainsaw (KinD) (pull_request) Successful in 16s
Required
Details
e2e / Validate Renovate config (pull_request) Successful in 1m0s
Required
Details
e2e / Lint & static validation (pull_request) Successful in 1m0s
Required
Details
e2e / Flux-local render (pull_request) Successful in 1m29s
Required
Details
This pull request has changes conflicting with the target branch.
  • kubernetes/apps/arc-systems/gha-runner-scale-set-heavy/app/helmrelease.yaml
  • kubernetes/apps/arc-systems/gha-runner-scale-set/app/helmrelease.yaml
  • kubernetes/apps/forgejo/forgejo-runner/app/scaledjob.yaml
  • kubernetes/apps/ploeg/ploeg/app/helmrelease.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin +refs/pull/443/head:ryangr0/fix/runner-image-pins
git switch ryangr0/fix/runner-image-pins
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

No labels
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/homelab-cluster!443
No description provided.