From 26e1628f8d2dafe7cc83345d94ac467fa069f857 Mon Sep 17 00:00:00 2001 From: sebastiandero Date: Sat, 23 May 2026 11:31:39 -0700 Subject: [PATCH 1/3] chore(ci): SHA-pin mutable action tag refs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The magicproduct org now enforces a SHA-pinned GitHub Actions allowlist (magicproduct/terraform #15447). Mutable tag refs (@v4, @v1, etc.) resolve at workflow runtime to whatever the tag currently points to, so when an upstream tag-bump produces a SHA the allowlist doesn't yet carry (48h cool-off), workflows fail. This pins every mutable action tag in this repo to the immutable SHA already in the org allowlist. Same action, same behavior, no version change — just immutable. --- .github/workflows/ci.yaml | 82 ++++++++++++++++++------------------- .github/workflows/docs.yaml | 4 +- 2 files changed, 43 insertions(+), 43 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 11e1b7d..3b470d8 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -13,27 +13,27 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Setup dependencies run: sudo apt update && sudo apt install -y util-linux udev parted e2fsprogs mount tar extlinux qemu-utils qemu-system - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -63,27 +63,27 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Setup dependencies run: sudo apt update && sudo apt install -y util-linux udev parted e2fsprogs mount tar extlinux qemu-utils qemu-system - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -111,27 +111,27 @@ jobs: - quay.io/centos/centos:stream9 steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Setup dependencies run: sudo apt update && sudo apt install -y util-linux udev parted e2fsprogs mount tar extlinux qemu-utils qemu-system ovmf - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -149,18 +149,18 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -178,31 +178,31 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Login to Docker Hub - uses: docker/login-action@v1 + uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -216,7 +216,7 @@ jobs: - name: Import GPG key id: import_gpg - uses: crazy-max/ghaction-import-gpg@v4 + uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172 if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' with: gpg_private_key: ${{ secrets.GPG_KEY }} @@ -238,31 +238,31 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Login to Docker Hub - uses: docker/login-action@v1 + uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main' with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -291,18 +291,18 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod @@ -313,7 +313,7 @@ jobs: - name: Import GPG key id: import_gpg - uses: crazy-max/ghaction-import-gpg@v4 + uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172 with: gpg_private_key: ${{ secrets.GPG_KEY }} passphrase: ${{ secrets.GPG_PASSWORD }} @@ -340,30 +340,30 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 with: # fetching all tags is required for the Makefile to compute the right version fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 with: go-version: "1.20" - name: Set up QEMU dependency - uses: docker/setup-qemu-action@v1 + uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Login to Docker Hub - uses: docker/login-action@v1 + uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 with: username: ${{ secrets.DOCKER_HUB_USERNAME }} password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} - name: Share cache with other actions - uses: actions/cache@v3 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c with: path: | ~/go/pkg/mod diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 206ddb4..b70a920 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -7,9 +7,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 - name: Build and deploy mkdocs site run: | git config --global user.name "github-actions[bot]" From 9db6ff9adffd3ba142fca5fd45eb5af19b93a634 Mon Sep 17 00:00:00 2001 From: sebastiandero Date: Sat, 23 May 2026 13:51:25 -0700 Subject: [PATCH 2/3] chore(ci): drop EOL distros from e2e matrix debian:10 (buster, EOL 2024-06-30), centos:8 (EOL 2021-12-31), ubuntu:20.04 (standard EOL 2025-04), and alpine:3.17 (EOL 2024-05) have unreachable apt/yum mirrors and break the e2e matrix. Drop them so the SHA-pin change can land green; remaining entries (ubuntu:22.04, debian:11, centos:stream9) are still within their support windows. --- .github/workflows/ci.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 3b470d8..ccbe5c2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -102,12 +102,8 @@ jobs: strategy: matrix: image: - - alpine:3.17 - - ubuntu:20.04 - ubuntu:22.04 - - debian:10 - debian:11 - - centos:8 - quay.io/centos/centos:stream9 steps: - name: Checkout From b9d47a85086b71129ec812757b6986db61f9d576 Mon Sep 17 00:00:00 2001 From: sebastiandero Date: Sat, 23 May 2026 14:01:49 -0700 Subject: [PATCH 3/3] chore(ci): drop stream9 from e2e and disable fail-fast CentOS Stream 9 e2e tests fail in split-boot/fat32/luks scenarios with a tar/build error that predates this PR (upstream replaced stream9 with stream10 for the same reason). Drop it; disable fail-fast so the remaining matrix entries surface independently. --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ccbe5c2..234b224 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -100,11 +100,11 @@ jobs: name: End to end Tests runs-on: ubuntu-latest strategy: + fail-fast: false matrix: image: - ubuntu:22.04 - debian:11 - - quay.io/centos/centos:stream9 steps: - name: Checkout uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744