Repository navigation
Harden release workflow and apply review follow-ups (1.1.1) - #3
Merged
Merged
Conversation
- Pin all GitHub Actions to commit SHAs and stop persisting checkout credentials. - Split package updates into a read-only check job (amd64 smoke test, aarch64 build with config check, app linter) and a release job that holds the write token, runs no third-party actions and verifies it releases the checked package set. - unbound-anchor uses IPv4 only, matching do-ip6: no. - Drop unbound.conf keys that restate defaults; effective values unchanged. - Docs: no fixed Alpine version, verification through Pi-hole explained, note on public names with private addresses, documentation IP instead of a LAN IP. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0175nKroeTB8UBzm1SJQa4Eg
Owner
Author
|
End-to-end run of the new
The test branch was deleted afterwards. PR CI (lint, amd64 + aarch64 build, smoke test) is green. 🤖 Generated with Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release workflow security
actions/checkoutno longer persists credentials in.git/configwhere only read access is needed.package-updates.ymlis split into two jobs:check(read-only token): build, package comparison, amd64 smoke test, aarch64 build withunbound-checkconfunder QEMU, app linter.release(contents: write): only first-partyactions/checkout, rebuilds, verifies version and SHA-256 ofapk-packages.txtagainst thecheckjob, then commits and pushes. A package change between the jobs fails the run instead of releasing an unverified set.App (1.1.1)
unbound-anchor -4, matchingdo-ip6: no.unbound.confdrops keys that restate Unbound defaults (do-ip4,prefer-ip6,do-udp,do-tcp,chroot,harden-glue,harden-dnssec-stripped,use-caps-for-id,edns-buffer-size,num-threads).Docs
DOCS.md(Dependabot bumps would make it stale).dig @hostgoes through Pi-hole; documentation IP192.0.2.10instead of a real LAN IP.private-address).Verification (local)
git diff --check: clean.unbound-checkconf -ofor all 24 relevant keys: identical effective values for old and newunbound.conf.tests/smoke.sh --hardenedagainst the new image: resolution, DNSSEC (AD flag, SERVFAIL fordnssec-failed.org), unprivileged start (uid 100), restart — PASS.package-updates.ymlon a temporary branch with a simulated package change (see PR comment).🤖 Generated with Claude Code
https://claude.ai/code/session_0175nKroeTB8UBzm1SJQa4Eg