Adding GHCR to CI/CD Release Workflow & further improvements #743

New Issue

MrUnknownDE · 2026-04-05T17:38:00+02:00

MrUnknownDE commented

2026-04-05 17:38:00 +02:00

Originally created by @marcschaeferger on 10/21/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description Copilot

This pull request updates GitHub Actions workflows to improve security, reliability, and supply-chain integrity by pinning all action dependencies to specific commit SHAs and enhancing job configurations. The CI/CD pipeline receives significant upgrades for container signing, mirroring, and artifact handling, while the linting and test workflows now use a dedicated runner and stricter permissions.

Security & Supply Chain Improvements

All workflow actions are now pinned to specific commit SHAs to mitigate supply-chain risks, replacing version tags with SHA references across all workflows (cicd.yml, linting.yml, test.yml, stale-bot.yml). [1] [2] [3] [4]

CI/CD Pipeline Enhancements

Added detailed permissions, concurrency controls, and a job-level timeout to the cicd.yml workflow. The pipeline now supports building, publishing, mirroring, and dual-signing container images for both Docker Hub and GHCR, including artifact uploads and digest-based verification. [1] [2]
Introduced steps to install skopeo, jq, and cosign for image mirroring and signing, with dual-signing (keyless and key-based) and verification for both registries.

Runner & Permissions Updates

All workflows (linting.yml, test.yml, cicd.yml) now run on the custom amd64-runner instead of ubuntu-latest, and include explicit permissions blocks to restrict access to only necessary scopes. [1] [2] [3] [4] [5]

Workflow Reliability

Added concurrency controls to the CI/CD workflow to prevent overlapping runs on tag pushes, and job-level timeouts to avoid stuck jobs.

Artifact & Secret Management

Improved documentation for required secrets and environment variables in the CI/CD workflow, and updated artifact upload steps to use pinned actions. [1] [2]

How to test?

*Originally created by @marcschaeferger on 10/21/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description Copilot This pull request updates GitHub Actions workflows to improve security, reliability, and supply-chain integrity by pinning all action dependencies to specific commit SHAs and enhancing job configurations. The CI/CD pipeline receives significant upgrades for container signing, mirroring, and artifact handling, while the linting and test workflows now use a dedicated runner and stricter permissions. **Security & Supply Chain Improvements** * All workflow actions are now pinned to specific commit SHAs to mitigate supply-chain risks, replacing version tags with SHA references across all workflows (`cicd.yml`, `linting.yml`, `test.yml`, `stale-bot.yml`). [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[2]](diffhunk://#diff-717013d02a8afac81852f25ba8ecd3cc0ca53a7f1fe25bedebfd66d6f518d21cL18-R27) [[3]](diffhunk://#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88L11-R19) [[4]](diffhunk://#diff-7d98caa1d6d6648f3266503a806c5b7dc6214839a1a1fabd7dcaa5c54d72222eL17-R17) **CI/CD Pipeline Enhancements** * Added detailed permissions, concurrency controls, and a job-level timeout to the `cicd.yml` workflow. The pipeline now supports building, publishing, mirroring, and dual-signing container images for both Docker Hub and GHCR, including artifact uploads and digest-based verification. [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[2]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R93-R181) * Introduced steps to install `skopeo`, `jq`, and `cosign` for image mirroring and signing, with dual-signing (keyless and key-based) and verification for both registries. **Runner & Permissions Updates** * All workflows (`linting.yml`, `test.yml`, `cicd.yml`) now run on the custom `amd64-runner` instead of `ubuntu-latest`, and include explicit permissions blocks to restrict access to only necessary scopes. [[1]](diffhunk://#diff-717013d02a8afac81852f25ba8ecd3cc0ca53a7f1fe25bedebfd66d6f518d21cL18-R27) [[2]](diffhunk://#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88L11-R19) [[3]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[4]](diffhunk://#diff-faff1af3d8ff408964a57b2e475f69a6b7c7b71c9978cccc8f471798caac2c88R3-R5) [[5]](diffhunk://#diff-717013d02a8afac81852f25ba8ecd3cc0ca53a7f1fe25bedebfd66d6f518d21cR3-R5) **Workflow Reliability** * Added concurrency controls to the CI/CD workflow to prevent overlapping runs on tag pushes, and job-level timeouts to avoid stuck jobs. **Artifact & Secret Management** * Improved documentation for required secrets and environment variables in the CI/CD workflow, and updated artifact upload steps to use pinned actions. [[1]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R3-R58) [[2]](diffhunk://#diff-6727e33ccc9195d67f0786e1384f8f1cdaf4090c3e77547943105bd2b28c99d0R93-R181) ## How to test?

MrUnknownDE closed this issue

2026-04-05 17:38:00 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#743