Chore: pin Docker images by digest, add Zod hook validation (KI-49)

Chore: pin Docker images by digest, add Zod hook validation #49

Merged

wasabi opened 1 week ago

Follow-up to KI-48.

Base Image Pinning:

Pin all Dockerfile FROM and Compose image: refs to @sha256 digests (re-verified immediately before commit).
Add scripts/check-image-digests.sh and run it from .onedev-buildspec.yml to fail on unpinned images going forward.

Hooks Zod Validation (M3):

Add Zod as a runtime dependency.
Define structural schemas for high-risk collections: agent_task, ai_summary, agent_action_log, impact_claim, stakeholder_feedback, and financial events.
Use full schemas for create hooks and partial schemas for update hooks; preserve unknown fields via passthrough.
Wire Zod validation ahead of existing governance/authorization/tenant/workflow checks.
Add Vitest coverage for valid/invalid types, enum/status values, partial updates, unknown-field preservation, and sanitized error messages.

Docker socket runner-isolation mitigation remains a separate coordinated infrastructure change requiring OneDev runner-owner approval.

Commits were merged into target branch

chore: pin Docker images by digest, add Zod hook payload validation

- Pin all Dockerfile and Compose image refs to @sha256 digests (re-verified
  immediately before commit) and add scripts/check-image-digests.sh to CI.
- Add Zod as a runtime dependency and define structural schemas for high-risk
  collections: agent_task, ai_summary, agent_action_log, impact_claim,
  stakeholder_feedback, and financial events (expense/sales/revenue).
- Wire Zod validation ahead of existing governance/authorization/workflow
  checks in create/update hooks; use full schemas for creates and partial
  schemas for updates; preserve unknown fields via passthrough.
- Add Vitest coverage for valid/invalid types, enum/status values, partial
  updates, unknown-field preservation, and sanitized error messages.

Docker socket runner-isolation mitigation remains a coordinated infra
follow-up requiring OneDev runner-owner approval.

1 week ago

ecee399c

wasabi merged 1 week ago
Login to comment

Submitter	wasabi
Target	main
Source	chore/image-pinning-hook-validation

Jobs

Merge Strategy

Create Merge Commit

Watchers (1)

Reference

pull request KI-49