tektoncd / tektoncd/pipelines-as-code
Pin the released images by digest in `release.k8s.yaml` / `release.yaml`
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 214
- Forks
- 144
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 27
Description
Feature request
The published install manifests reference the controller/watcher/webhook images by mutable tag only, e.g. for v0.50.0:
ghcr.io/tektoncd/pipelines-as-code/pipelines-as-code-controller:v0.50.0
ghcr.io/tektoncd/pipelines-as-code/pipelines-as-code-watcher:v0.50.0
ghcr.io/tektoncd/pipelines-as-code/pipelines-as-code-webhook:v0.50.0
Would you be open to additionally pinning these to an immutable digest, i.e. …:v0.50.0@sha256:…? Tekton Pipelines' release manifest already does this for every image, so applying a pinned PaC release would then be fully reproducible in the same way.
Use case
Consumers who vendor the release manifest for supply-chain reasons (air-gapped installs, checksum-pinned GitOps, registry mirroring) currently get a manifest whose bytes are fixed but whose image contents are not.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read release.k8s.yaml and release.yaml first, then compare their image references with the Tekton Pipelines release-manifest precedent mentioned in the issue. Pin the controller, watcher, and webhook images with immutable sha256 digests while retaining their release tags, and verify both manifests contain the expected pins.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes
- Domain
- devops, release
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100