fix(runners): move the runner pool to ci-runner 1.2.3 #545

Merged

ryangr0 merged 1 commit from fix/runner-image-1-2-3 into main

2026-08-07 11:37:47 +00:00

ryangr0 commented

2026-08-07 11:29:13 +00:00

Owner

1.2.3 is the first ci-runner that bakes grype and the cve-gate binary (infrastructure #91). That's what lets the CVE budget gate stop being a docker run against a remote dind daemon and become a step calling a binary on PATH.

infrastructure #90 depends on this bump — it fails with an explicit message naming this pin when the runner is older, rather than cve-gate: command not found.

Why I'm confident the binaries work

Not because the COPY succeeded. #91 added a build-time guard that runs grype version and asserts cve-gate reaches its own argument validation:

IMAGE_REF= cve-gate 2>&1 | grep -q 'IMAGE_REF is required'

That guard ran during 1.2.3's build and passed — the image wouldn't exist otherwise.

The digest is unsigned, and that's stated in the manifest

As 1.2.1 and 1.2.2 were. The gate that would have signed it is precisely the thing being fixed, and it has now failed six times on container plumbing rather than on CVEs:


cve-gate 0.3.0	`docker cp` into a `--read-only` rootfs
run 221	a tag that was never built
run 224	an inverted seccomp `clone` rule
run 234	a 2 GB tmpfs
run 238	volumes created root-owned
run 249	`chown: Operation not permitted` — `--cap-drop ALL` removes `CAP_CHOWN` from root

image-verify-harbor-audit is in Audit, so nothing blocks. I've written the caveat into the manifest rather than leaving it to be noticed later; it resolves on the first release that gets through a working gate — which is what #90 is for.

Rollout

rollout.strategy is already gradual, so in-flight runners finish on the old spec and only new pods pick this up. The existing comment about a ci-runner release killing its own runner still holds and is why that setting is there.

**1.2.3 is the first ci-runner that bakes `grype` and the `cve-gate` binary** ([infrastructure #91](https://forgejo.webgrip.dev/webgrip/infrastructure/pulls/91)). That's what lets the CVE budget gate stop being a `docker run` against a remote dind daemon and become a step calling a binary on `PATH`. **[infrastructure #90](https://forgejo.webgrip.dev/webgrip/infrastructure/pulls/90) depends on this bump** — it fails with an explicit message naming this pin when the runner is older, rather than `cve-gate: command not found`. ## Why I'm confident the binaries work Not because the `COPY` succeeded. #91 added a build-time guard that runs `grype version` and asserts `cve-gate` reaches its own argument validation: ```dockerfile IMAGE_REF= cve-gate 2>&1 | grep -q 'IMAGE_REF is required' ``` That guard ran during 1.2.3's build and passed — the image wouldn't exist otherwise. ## The digest is unsigned, and that's stated in the manifest As 1.2.1 and 1.2.2 were. The gate that would have signed it is precisely the thing being fixed, and it has now failed **six times on container plumbing rather than on CVEs**: | | | |---|---| | cve-gate 0.3.0 | `docker cp` into a `--read-only` rootfs | | run 221 | a tag that was never built | | run 224 | an inverted seccomp `clone` rule | | run 234 | a 2 GB tmpfs | | run 238 | volumes created root-owned | | run 249 | `chown: Operation not permitted` — `--cap-drop ALL` removes `CAP_CHOWN` from root | `image-verify-harbor-audit` is in Audit, so nothing blocks. I've written the caveat into the manifest rather than leaving it to be noticed later; it resolves on the first release that gets through a working gate — which is what #90 is for. ## Rollout `rollout.strategy` is already `gradual`, so in-flight runners finish on the old spec and only new pods pick this up. The existing comment about a ci-runner release killing its own runner still holds and is why that setting is there.

ryangr0 added 1 commit

2026-08-07 11:29:13 +00:00

fix(runners): move the runner pool to ci-runner 1.2.3

e2e / Kyverno Chainsaw (KinD) (pull_request) Successful in 11s

Details

e2e / Lint & static validation (pull_request) Successful in 46s

Details

e2e / Validate Renovate config (pull_request) Successful in 52s

Details

e2e / Flux-local render (pull_request) Successful in 42s

Details

049c78d734

1.2.3 is the first ci-runner that bakes `grype` and the `cve-gate` binary
(webgrip/infrastructure #91). That is what lets the CVE budget gate stop being a `docker run`
against a remote dind daemon and become a step calling a binary on PATH.

infrastructure #90 depends on this bump. It fails with an explicit message naming this pin when the
runner is older, rather than "cve-gate: command not found".

Confidence that the binaries actually work on this base does not rest on the copy succeeding: #91
added a build-time guard that runs `grype version` and asserts `cve-gate` reaches its own argument
validation. That guard ran during 1.2.3's build and passed, so the image would not exist otherwise.

The digest is UNSIGNED, as 1.2.1 and 1.2.2 before it were — the gate that would have signed it is
precisely the thing being fixed, and it has now failed six times on container plumbing rather than
on CVEs (docker cp into a read-only rootfs, a tag that was never built, an inverted seccomp rule, a
2g tmpfs, root-owned volumes, and finally `chown: Operation not permitted` because --cap-drop ALL
removes CAP_CHOWN from root). image-verify-harbor-audit is in Audit so nothing blocks. Recorded in
the manifest rather than left to be noticed later; it resolves on the first release that gets
through a working gate.

rollout.strategy is already `gradual`, so in-flight runners finish on the old spec and only new
pods pick this up — the existing comment about a ci-runner release killing its own runner still
holds and is why that setting is there.

ryangr0 merged commit b9f349320c into main

2026-08-07 11:37:47 +00:00

ryangr0 referenced this pull request from a commit

2026-08-07 11:37:49 +00:00

Merge pull request 'fix(runners): move the runner pool to ci-runner 1.2.3' (#545) from fix/runner-image-1-2-3 into main