joakimp/pi-devbox

Fork 0

Files

T

pi 291ae5345e

Lint / hadolint (push) Successful in 9s

Details

Lint / actionlint (push) Successful in 16s

Details

repo: add LICENSE, THIRD_PARTY.md, .dockerignore, hadolint lint, IDEAS backlog

Repo/CI hygiene batch (none base-affecting; image contents unchanged):

- LICENSE: actual MIT file (repo previously declared MIT only in prose).
- THIRD_PARTY.md: notes bundled software + licenses (pi/pi-fork/pi-obsmem/
  pi-studio MIT, gosu Apache-2.0, Debian packages under their own terms).
- .dockerignore: trims build context to what the Dockerfiles COPY (rootfs/ +
  entrypoint*.sh); keeps .git/docs/scripts/compose out. Verified it excludes
  none of the required COPY sources.
- lint.yml: new hadolint job (pinned v2.14.0) lints both Dockerfiles;
  .hadolint.yaml grandfathers deliberate choices (DL3008/DL3016/DL4006/DL3003/
  SC2086, mirroring the shellcheck excludes), fails on anything new at warning+.
  Verified hadolint exit 0 and the repo shell-guard passes with the new job.
- IDEAS.md: parks deferred follow-ups (SHA-pin actions, trivy, buildx SBOM/
  provenance, Makefile, renovate).
- README/DOCKER_HUB License sections now link LICENSE + THIRD_PARTY.md.

No tag.

2026-07-13 18:20:44 +02:00

2.9 KiB

Raw Permalink Blame History

Ideas & backlog

A living list of potential improvements for pi-devbox that are not yet scheduled. This is intentionally lightweight — a place to park ideas so they aren't lost between sessions. When an item ships, describe it in CHANGELOG.md and remove it from here.

Rough effort tags: 🟢 small · 🟡 medium · 🔴 large. Status: idea (unvetted) · planned (agreed, not started).

Supply-chain hardening

🟡 planned — Pin CI actions to commit SHAs. The workflows use floating major tags (actions/checkout@v4, docker/build-push-action@v7, docker/setup-buildx-action@v4, docker/login-action@v3, docker/setup-qemu-action@v3). This is inconsistent with the project's own philosophy of SHA-pinning content refs (pi, pi-studio, pi-fork, …) to defeat floating refs. Pin each action to a SHA with a trailing # vX.Y.Z comment. Pairs naturally with the renovate item below to keep the pins fresh.
🟡 planned — Vulnerability scanning in CI. No CVE scan runs on the published images today. Add a trivy image (or grype) job to docker-publish.yml after smoke. Start non-blocking (report only), then tighten to fail on HIGH/CRITICAL with an available fix.
🟢🟡 planned — Standardize build provenance → buildx SBOM + attestations. The image already carries hand-rolled provenance (OCI labels + build-manifest). docker/build-push-action can emit a standard SBOM and SLSA provenance attestation nearly for free (provenance: mode=max, sbom: true). Makes provenance machine-consumable and pairs well with the trivy item (scan the SBOM).

Dockerfile hardening

🟡 idea — Address hadolint DL4006 properly. Currently ignored in .hadolint.yaml. The clean fix is SHELL ["/bin/bash", "-o", "pipefail", "-c"] so piped RUNs fail on the first non-zero stage. This changes the default RUN shell from sh to bash for all subsequent layers, so it is base-affecting and needs a careful pass over existing RUNs before removing the ignore.

Developer experience

🟢 idea — Makefile/justfile for local iteration. Reproducing a CI build locally means hand-assembling many --build-args. Thin targets (make build-base, make build-variant, make smoke, make lint) would make local testing painless and document the canonical invocations.
🟡 idea — Dependency-update automation (renovate). With CI actions SHA-pinned (above), a renovate.json keeps those pins — plus the pinned tool versions (ACTIONLINT_VERSION, HADOLINT_VERSION, gosu, etc.) — current via automated PRs. Requires a renovate runner against the Gitea instance.

Housekeeping

🟢 idea — Registry retention for base-<hash> tags. The base-hash caching scheme accumulates base-<hash> tags over time. Confirm whether the registry prunes old ones, and add a retention/cleanup step if not.