ComplianceAsCode / ComplianceAsCode/content

k8scontent container images missing for v0.1.79 and v0.1.80 releases

Open
#14,681 4 comments 0 reactions 0 assignees View on GitHub
triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

## Summary

The `ghcr.io/complianceascode/k8scontent` container image does not have tags corresponding to the v0.1.79 and v0.1.80 releases. The `:latest` tag is pinned to a June 2025 build (commit `b01ffe68cc1320ee472408798bc56d83cfbfb1f7`), which predates both releases.

## Evidence

```bash
# :latest is from June 2025 — predates v0.1.78 (Sep 2025), v0.1.79 (Nov 2025), v0.1.80 (Mar 2026)
$ skopeo inspect --override-arch amd64 --override-os linux docker://ghcr.io/complianceascode/k8scontent:latest
"Created": "2025-06-13T17:17:53.170052561Z"
"org.opencontainers.image.revision": "b01ffe68cc1320ee472408798bc56d83cfbfb1f7"

# No version-tagged images exist
$ skopeo inspect docker://ghcr.io/complianceascode/k8scontent:v0.1.79
name unknown: repository not found

$ skopeo inspect docker://ghcr.io/complianceascode/k8scontent:v0.1.80
name unknown: repository not found
```

## Impact

The compliance-operator [references `k8scontent:latest`](https://github.com/ComplianceAsCode/compliance-operator/blob/master/config/manager/deployment.yaml) in its deployment manifest via `RELATED_IMAGE_PROFILE`. Since `:latest` hasn't been updated since June 2025:

1. **Scan results are not reproducible** — different clusters pulling `:latest` at different times could get different content if the tag ever updates
2. **New features are unavailable** — v0.1.80 added `sshd_runtime_check` for RHCOS ([products/rhcos4/product.yml](https://github.com/ComplianceAsCode/content/blob/master/products/rhcos4/product.yml#L25)), but no cluster using the published images will have it
3. **No way to pin to a release** — without version-tagged images, users cannot reference a specific content release for reproducibility

## Request

1. Publish `ghcr.io/complianceascode/k8scontent:v0.1.79` and `ghcr.io/complianceascode/k8scontent:v0.1.80` images
2. Update `:latest` to point to the current release (v0.1.80) — the compliance-operator [defaults to `:latest`](https://github.com/ComplianceAsCode/compliance-operator/blob/master/pkg/utils/images.go) when `RELATED_IMAGE_PROFILE` is not overridden
3. Consider publishing version-tagged images as part of the release process going forward (the `Dockerfiles/ocp4_content` Dockerfile already exists for this purpose)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.