pi
291ae5345e
Repo/CI hygiene batch (none base-affecting; image contents unchanged): - LICENSE: actual MIT file (repo previously declared MIT only in prose). - THIRD_PARTY.md: notes bundled software + licenses (pi/pi-fork/pi-obsmem/ pi-studio MIT, gosu Apache-2.0, Debian packages under their own terms). - .dockerignore: trims build context to what the Dockerfiles COPY (rootfs/ + entrypoint*.sh); keeps .git/docs/scripts/compose out. Verified it excludes none of the required COPY sources. - lint.yml: new hadolint job (pinned v2.14.0) lints both Dockerfiles; .hadolint.yaml grandfathers deliberate choices (DL3008/DL3016/DL4006/DL3003/ SC2086, mirroring the shellcheck excludes), fails on anything new at warning+. Verified hadolint exit 0 and the repo shell-guard passes with the new job. - IDEAS.md: parks deferred follow-ups (SHA-pin actions, trivy, buildx SBOM/ provenance, Makefile, renovate). - README/DOCKER_HUB License sections now link LICENSE + THIRD_PARTY.md. No tag.
61 lines
2.9 KiB
Markdown
61 lines
2.9 KiB
Markdown
# Ideas & backlog
|
|
|
|
A living list of potential improvements for pi-devbox that are **not yet
|
|
scheduled**. This is intentionally lightweight — a place to park ideas so they
|
|
aren't lost between sessions. When an item ships, describe it in
|
|
[`CHANGELOG.md`](CHANGELOG.md) and remove it from here.
|
|
|
|
Rough effort tags: 🟢 small · 🟡 medium · 🔴 large. Status: `idea` (unvetted) ·
|
|
`planned` (agreed, not started).
|
|
|
|
---
|
|
|
|
## Supply-chain hardening
|
|
|
|
- 🟡 `planned` — **Pin CI actions to commit SHAs.** The workflows use floating
|
|
major tags (`actions/checkout@v4`, `docker/build-push-action@v7`,
|
|
`docker/setup-buildx-action@v4`, `docker/login-action@v3`,
|
|
`docker/setup-qemu-action@v3`). This is inconsistent with the project's own
|
|
philosophy of SHA-pinning *content* refs (pi, pi-studio, pi-fork, …) to defeat
|
|
floating refs. Pin each action to a SHA with a trailing `# vX.Y.Z` comment.
|
|
Pairs naturally with the renovate item below to keep the pins fresh.
|
|
|
|
- 🟡 `planned` — **Vulnerability scanning in CI.** No CVE scan runs on the
|
|
published images today. Add a `trivy image` (or grype) job to
|
|
`docker-publish.yml` after `smoke`. Start non-blocking (report only), then
|
|
tighten to fail on `HIGH`/`CRITICAL` with an available fix.
|
|
|
|
- 🟢🟡 `planned` — **Standardize build provenance → buildx SBOM + attestations.**
|
|
The image already carries hand-rolled provenance (OCI labels +
|
|
`build-manifest`). `docker/build-push-action` can emit a standard SBOM and
|
|
SLSA provenance attestation nearly for free (`provenance: mode=max`,
|
|
`sbom: true`). Makes provenance machine-consumable and pairs well with the
|
|
trivy item (scan the SBOM).
|
|
|
|
## Dockerfile hardening
|
|
|
|
- 🟡 `idea` — **Address hadolint DL4006 properly.** Currently ignored in
|
|
`.hadolint.yaml`. The clean fix is `SHELL ["/bin/bash", "-o", "pipefail",
|
|
"-c"]` so piped `RUN`s fail on the first non-zero stage. This changes the
|
|
default `RUN` shell from `sh` to `bash` for all subsequent layers, so it is
|
|
base-affecting and needs a careful pass over existing `RUN`s before removing
|
|
the ignore.
|
|
|
|
## Developer experience
|
|
|
|
- 🟢 `idea` — **`Makefile`/`justfile` for local iteration.** Reproducing a CI
|
|
build locally means hand-assembling many `--build-arg`s. Thin targets
|
|
(`make build-base`, `make build-variant`, `make smoke`, `make lint`) would
|
|
make local testing painless and document the canonical invocations.
|
|
|
|
- 🟡 `idea` — **Dependency-update automation (renovate).** With CI actions
|
|
SHA-pinned (above), a `renovate.json` keeps those pins — plus the pinned tool
|
|
versions (`ACTIONLINT_VERSION`, `HADOLINT_VERSION`, gosu, etc.) — current via
|
|
automated PRs. Requires a renovate runner against the Gitea instance.
|
|
|
|
## Housekeeping
|
|
|
|
- 🟢 `idea` — **Registry retention for `base-<hash>` tags.** The base-hash
|
|
caching scheme accumulates `base-<hash>` tags over time. Confirm whether the
|
|
registry prunes old ones, and add a retention/cleanup step if not.
|