Harden CI supply chain and base the image on Ubuntu 24.04 - #18
Merged
Conversation
Pins all five actions to full commit SHAs with version comments, so a retagged upstream release cannot change what runs. Adds dependabot for docker and github-actions on a weekly schedule with a 7 day cooldown, which keeps a freshly published version from being adopted immediately. Also moves the actions to current majors: checkout v4 to v7, setup-buildx v3 to v4, metadata v5 to v6, login v3 to v4, build-push v6 to v7.
The machine type was whatever the qemu build defaulted to, with no way to override it. Setting it lets a guest keep identical virtual hardware across a qemu upgrade, which matters for guests that treat a hardware change as significant. Defaults to empty so qemu keeps choosing and current behaviour is unchanged.
Moves qemu from 6.2 to 8.2.2 and picks up mature aio=io_uring and better multiqueue virtio-scsi handling. Ubuntu 22.04 standard support ends April 2027. Base is pinned by digest so rebuilds are reproducible and dependabot can propose the bump explicitly. The default machine type moves from pc-i440fx-6.2 to pc-i440fx-8.2, so guest visible hardware changes on the next restart after this ships in a release. Set MACHINE=pc-i440fx-6.2 to hold the old one.
metadata-action matched no rule on pull_request events, so it emitted no tags and warned "No Docker tag has been generated" on every PR. Adds type=ref,event=pr for a pr-N tag. PR builds still do not push.
aemr3
added a commit
that referenced
this pull request
Aug 22, 2026
26.04 LTS became the current stable release in April 2026 and supersedes the 24.04 base from #18. Moves qemu from 8.2.2 to 10.2.1 and extends standard support from April 2029 to 2031. pc-i440fx-6.2 is still present in qemu 10.2, marked deprecated, so MACHINE can still hold a guest on the old machine type. The default machine type is now pc-i440fx-10.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three commits, separated so the base bump can be reverted on its own.
Pin actions + dependabot — all five actions pinned to full commit SHAs, so a retagged upstream release can't change what runs. Dependabot for docker and github-actions, weekly, with a 7 day cooldown so a freshly published version isn't adopted immediately. Actions also moved to current majors (checkout v4→v7, setup-buildx v3→v4, metadata v5→v6, login v3→v4, build-push v6→v7).
MACHINEenv var — the machine type was whatever qemu defaulted to, with no override. Defaults to empty, so behaviour is unchanged.Ubuntu 24.04 — qemu 6.2 → 8.2.2, picking up mature
aio=io_uringand better multiqueue virtio-scsi. 22.04 standard support ends April 2027. Base pinned by digest.Before releasing this
The default machine type moves
pc-i440fx-6.2→pc-i440fx-8.2, so guest visible hardware changes on the first restart after this reaches a tag. Merging alone is safe — it publishesedgeonly, andlatestdoesn't move until av*tag.Windows guests may treat that as a hardware change.
MACHINE=pc-i440fx-6.2holds the old one per container.Worth bringing up one disposable VM on
edgeand checking the guest's interface name and PCI addresses before tagging.