feat(base): add debian/13/amd64 evidence-runs tuple#715
Merged
Conversation
Add the debian/13/amd64 base-image tuple to the v5 evidence-runs matrix, completing Debian 13 (Trixie) coverage alongside the existing arm64 tuple. - New base-images/debian/13/amd64/Dockerfile — FROM debian:13-slim with the shared minimal+hardened layer (arch label amd64). debian:13-slim tag availability is confirmed by the existing debian/13/arm64 tuple already building in CI. - Register the tuple in the build-base-images.yml matrix (amd64 before arm64, matching the version-12 ordering). - Add debian/13/amd64 to REQUIRED_TUPLES in tests/unit/base-images-structure.sh. Closes #431
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
debian/13/amd64base-image tuple to the v5 evidence-runs matrix,completing Debian 13 (Trixie) coverage alongside the existing
debian/13/arm64.base-images/debian/13/amd64/Dockerfile—FROM debian:13-slimwith theshared minimal + hardened layer (
hardening.sh), non-rootrunner(UID/GID1000),
/etc/shellsrestricted to bash, service users → nologin, passwordlesssudo off. Identical to the
debian/13/arm64sibling except the arch identity(header comment, LABEL title/description,
io.containers.base-image.arch).build-base-images.ymlmatrix (amd64 before arm64,matching the version-12 ordering).
debian/13/amd64toREQUIRED_TUPLESintests/unit/base-images-structure.sh.debian:13-slimtag availability is confirmed by the existingdebian/13/arm64tuple already building in CI.
Test plan
just test— full unit suite (3143 passed, 0 failed, 5 skipped), includingbase-images-structure.shexercising the new tuple.hadolinton the new Dockerfile — clean.actionlinton the workflow — clean.Build Base Imagesbuildsbase-debian-13-amd64on this PR (build +Trivy scan, no publish); publish + cosign sign + SBOM attest run on merge to main.
Review findings
Adversarial pre-PR review: clean, 0 blocking. Two deferrable test-coverage
enhancements surfaced (not defects in this PR) — will file as follow-ups:
FROMversiontoken and
io.containers.base-image.*LABELs match its directory path(guards copy-paste drift across all tuples).
REQUIRED_TUPLESand the workflow matrix(currently kept in sync by a code comment).
Closes #431