Nguyen Minh Phuc
ca21b6e70d
ci / lint (push) Successful in 18s
ci / dockerfile (push) Successful in 18s
ci / chart (push) Successful in 19s
ci / security (push) Successful in 1m7s
ci / integration (push) Successful in 48s
ci / unit (push) Successful in 37s
ci / types (push) Successful in 50s
ci / image (api) (push) Successful in 2m17s
ci / image (reconciler) (push) Successful in 2m36s
ci / image (worker) (push) Successful in 1m30s
ci / bump (push) Successful in 14s
The secret-scanning gate has been green and meaningless. `docker run -v "$PWD:/repo"`
resolves the bind source on the dind sidecar's daemon, not in the job container, so
gitleaks received an empty mount:
ERR [git] fatal: not a git repository (or any parent up to mount point /)
ERR failed to scan Git repository error="stderr is not empty"
INF scan completed in 35.2ms
INF no leaks found <- exit 0
It logged the failure and exited 0. A scanner that reports success without looking is
worse than no scanner. The 35ms runtime was the tell.
Now a checksum-pinned binary, plus a `git rev-list --count HEAD` assertion so an
unscannable checkout fails the job instead of passing it.
Same root cause and same fix for yq in bump-digests.sh, which failed the bump job with
"stat deploy/chart/values.yaml: no such file or directory". helm was fixed this way
earlier. Nothing on this runner should mount $PWD into a container.