Merge pull request xencon#1732 from sbadakhc/issue-1730/release-v1-1-50

sbadakhc · web-flow · commit 5eafddb2fa4e · 2026-07-03T04:01:45.000+01:00
Release v1.1.50 (xencon#1730)
diff --git a/.claude/rules/ci-checks.md b/.claude/rules/ci-checks.md
@@ -69,6 +69,6 @@ gh pr create \
 shellcheck --severity=warning --exclude=SC1091 $(find . -name "*.sh" -not -path "./.git/*")
 
 # Individual checks
-./aixcl checks paths        # or: agents, elisions, generated, ascii, yaml, compose, env
+./aixcl checks paths        # or: agents, elisions, generated, ascii, pins, yaml, compose, env
 ./aixcl checks pr-refs <body-file>
 ```
diff --git a/.claude/skills/housekeeping/SKILL.md b/.claude/skills/housekeeping/SKILL.md
@@ -165,15 +165,19 @@ fi
 - [ ] If gitleaks not installed, note it as a tooling gap
 - [ ] Note: `--no-git` scans ALL files on disk, including gitignored runtime files (e.g. `pgadmin-servers.json`). Findings in gitignored runtime files belong in the `.gitleaks.toml` `paths` allowlist, not the `commits` allowlist.
 
-### Step 8 -- Docker Image Pin Hygiene
+### Step 8 -- Container Image Pin Hygiene
+
+Covers compose files AND shell code under `lib/` and `scripts/` -- four
+unpinned alpine references hid in shell code because the old sweep only
+scanned compose (issue #1726). Legitimate `:latest` uses (locally built
+`localhost/` images, ollama model tags) are exempted via `localhost/`
+detection or an inline `pin-waiver:` comment.
 
 ```bash
-grep -hn "image:" services/docker-compose*.yml | grep -v "#" | \
-  grep -E "image:\s+(\S+:latest\s*$|\S*/[^:]+\s*$|[^/:]+\s*$)" \
-  && echo "FAIL: unpinned image tags found above" || echo "ok: all images pinned"
+./aixcl checks pins
 ```
 
-- [ ] All images in all compose files use pinned version tags (no `latest`, no bare image names)
+- [ ] All container image references are pinned (no `latest`, no bare image names), or carry an explicit `pin-waiver:` comment with a reason
 
 ### Step 9 -- Shellcheck Sweep (All Scripts)
 
diff --git a/.opencode/rules/ci-checks.md b/.opencode/rules/ci-checks.md
@@ -69,6 +69,6 @@ gh pr create \
 shellcheck --severity=warning --exclude=SC1091 $(find . -name "*.sh" -not -path "./.git/*")
 
 # Individual checks
-./aixcl checks paths        # or: agents, elisions, generated, ascii, yaml, compose, env
+./aixcl checks paths        # or: agents, elisions, generated, ascii, pins, yaml, compose, env
 ./aixcl checks pr-refs <body-file>
 ```
diff --git a/.opencode/skills/housekeeping/SKILL.md b/.opencode/skills/housekeeping/SKILL.md
@@ -165,15 +165,19 @@ fi
 - [ ] If gitleaks not installed, note it as a tooling gap
 - [ ] Note: `--no-git` scans ALL files on disk, including gitignored runtime files (e.g. `pgadmin-servers.json`). Findings in gitignored runtime files belong in the `.gitleaks.toml` `paths` allowlist, not the `commits` allowlist.
 
-### Step 8 -- Docker Image Pin Hygiene
+### Step 8 -- Container Image Pin Hygiene
+
+Covers compose files AND shell code under `lib/` and `scripts/` -- four
+unpinned alpine references hid in shell code because the old sweep only
+scanned compose (issue #1726). Legitimate `:latest` uses (locally built
+`localhost/` images, ollama model tags) are exempted via `localhost/`
+detection or an inline `pin-waiver:` comment.
 
 ```bash
-grep -hn "image:" services/docker-compose*.yml | grep -v "#" | \
-  grep -E "image:\s+(\S+:latest\s*$|\S*/[^:]+\s*$|[^/:]+\s*$)" \
-  && echo "FAIL: unpinned image tags found above" || echo "ok: all images pinned"
+./aixcl checks pins
 ```
 
-- [ ] All images in all compose files use pinned version tags (no `latest`, no bare image names)
+- [ ] All container image references are pinned (no `latest`, no bare image names), or carry an explicit `pin-waiver:` comment with a reason
 
 ### Step 9 -- Shellcheck Sweep (All Scripts)
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,21 @@ All notable changes to the AIXCL project will be documented in this file.
 ## [Unreleased]
 
 
+## [v1.1.50] - 2026-07-03
+
+### Summary
+
+Release v1.1.50 -- Supply-chain hardening: every container image reference in the repository is now pinned, and a new check makes unpinned references anywhere in compose or shell code a CI failure.
+
+### Added
+
+- [x] **Image Pin Check**: new `./aixcl checks pins` (included in `checks all` and the housekeeping skill) sweeps compose files plus shell code under lib/ and scripts/ for `:latest`, untagged `FROM` lines in generated Dockerfile templates, and untagged registry references. Locally built `localhost/` images and explicitly annotated `pin-waiver:` cases are exempt. Closes #1728.
+
+### Fixed
+
+- [x] **Unpinned Alpine References**: four shell code paths (app provisioning, the generated app Dockerfile template, the env-restore helper, and the rootless setup smoke test) pulled `alpine:latest` or bare `alpine`; all are pinned to `docker.io/library/alpine:3.24.1`. These were invisible to the previous compose-only pin sweep. Closes #1726.
+
+
 ## [v1.1.49] - 2026-07-03
 
 ### Summary
diff --git a/completion/aixcl.bash b/completion/aixcl.bash
@@ -198,7 +198,7 @@ _aixcl_complete() {
             return 0
             ;;
         'checks')
-            local checks_actions="all paths agents elisions generated ascii yaml compose env pr-refs"
+            local checks_actions="all paths agents elisions generated ascii pins yaml compose env pr-refs"
             mapfile -t COMPREPLY < <(compgen -W "$checks_actions" -- "$cur")
             return 0
             ;;
diff --git a/lib/aixcl/commands/app.sh b/lib/aixcl/commands/app.sh
@@ -1027,7 +1027,7 @@ EOF
 
     # Write Dockerfile stub
     cat > "${app_dir}/docker/Dockerfile" << 'EOF'
-FROM alpine:latest
+FROM docker.io/library/alpine:3.24.1
 
 # TODO: Add your application here
 
diff --git a/lib/aixcl/commands/checks.sh b/lib/aixcl/commands/checks.sh
@@ -9,12 +9,13 @@ CHECKS_FAILED=()
 CHECKS_SKIPPED=()
 
 _checks_usage() {
-    echo "Usage: $0 checks {all|paths|agents|elisions|generated|ascii|yaml|compose|env|pr-refs <file>}"
+    echo "Usage: $0 checks {all|paths|agents|elisions|generated|ascii|pins|yaml|compose|env|pr-refs <file>}"
     echo "  all              Run every check below (continues on failure, prints summary)"
     echo "  paths            Documentation relative links and stale path patterns"
     echo "  agents           .claude/ vs .opencode/ rules and skills mirror parity"
     echo "  elisions         AI-elision placeholders and suspicious mass deletions"
     echo "  generated        Tracked generated files and stale artifacts"
+    echo "  pins             Container image references pinned (compose + shell code)"
     echo "  ascii            Non-ASCII punctuation in markdown files"
     echo "  yaml             yamllint over the repository"
     echo "  compose          docker compose config validation (main + overrides)"
@@ -140,6 +141,9 @@ function checks_cmd() {
         elisions)
             bash "${checks_dir}/check-ai-elisions.sh" "$@"
             ;;
+        pins)
+            bash "${checks_dir}/check-image-pins.sh"
+            ;;
         generated)
             bash "${checks_dir}/check-generated-files.sh"
             ;;
@@ -177,6 +181,7 @@ function checks_cmd() {
             _check_run "elisions" bash "${checks_dir}/check-ai-elisions.sh" || true
             _check_run "generated" bash "${checks_dir}/check-generated-files.sh" || true
             _check_run "ascii" _check_ascii || true
+            _check_run "pins" bash "${checks_dir}/check-image-pins.sh" || true
 
             if command -v yamllint > /dev/null 2>&1; then
                 _check_run "yaml" yamllint -c "${SCRIPT_DIR}/.yamllint.yml" "${SCRIPT_DIR}" || true
diff --git a/lib/aixcl/commands/models.sh b/lib/aixcl/commands/models.sh
@@ -9,9 +9,11 @@ is_model_installed() {
 
     case "$engine" in
         ollama)
-            # Ollama list shows models. We need to match the name exactly, or with :latest if missing tag
+            # Ollama list shows models. Match the name exactly, or with the
+            # default tag appended when the name carries none.
+            # (pin-waiver: ollama MODEL tags are not container images)
             local model_with_tag="$model"
-            [[ ! "$model" =~ : ]] && model_with_tag="${model}:latest"
+            [[ ! "$model" =~ : ]] && model_with_tag="${model}:latest"  # pin-waiver: ollama model tag
             "${DOCKER_BIN:-docker}" exec "$container" ollama list 2>/dev/null | awk '{print $1}' | grep -qE "^${model_with_tag}$"
             return $?
             ;;
diff --git a/lib/aixcl/commands/stack.sh b/lib/aixcl/commands/stack.sh
@@ -475,7 +475,7 @@ function start() {
                 --user "${current_uid}:${current_gid}" \
                 -v "${env_backup_volume}:/backup:ro" \
                 -v "${SCRIPT_DIR}:/target" \
-                alpine sh -c "test -f /backup/.env && cp /backup/.env /target/.env && chmod 600 /target/.env" >/dev/null 2>&1; then
+                docker.io/library/alpine:3.24.1 sh -c "test -f /backup/.env && cp /backup/.env /target/.env && chmod 600 /target/.env" >/dev/null 2>&1; then
                 if [ -f "$env_file" ]; then
                     # Fix ownership and permissions if file was created by root
                     if [ -O "$env_file" ] || [ -w "$env_file" ]; then
diff --git a/lib/core/app_provision.sh b/lib/core/app_provision.sh
@@ -137,7 +137,7 @@ _app_provision_render_secret() {
     local filename="$2"
     "${DOCKER_BIN:-docker}" run --rm -i --network none \
         -v "${volume}:/secrets" \
-        docker.io/library/alpine:latest \
+        docker.io/library/alpine:3.24.1 \
         sh -c "umask 077 && cat > /secrets/${filename}"
 }
 
diff --git a/scripts/checks/check-image-pins.sh b/scripts/checks/check-image-pins.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# check-image-pins.sh -- verify container image references are pinned
+#
+# Scans compose files AND shell code under lib/ and scripts/ for container
+# image references that use :latest or no tag at all. The compose-only
+# sweep missed four unpinned alpine references in shell code (issue #1726);
+# this check closes that gap (issue #1728).
+#
+# Rules:
+#   1. compose image: lines must carry a version tag (no :latest, no bare name)
+#   2. no :latest anywhere in *.sh / *.yml under lib/, scripts/, services/
+#      Exempt: localhost/ images (built locally from source, never pulled)
+#      and lines carrying an explicit "pin-waiver:" comment with a reason
+#      (e.g. ollama MODEL tags, which are not container images)
+#   3. FROM lines in heredoc Dockerfile templates must carry a non-latest tag
+#   4. registry-prefixed references (docker.io, ghcr.io, quay.io) in shell
+#      code must carry a tag
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+SELF="scripts/checks/check-image-pins.sh"
+fail=0
+
+report() {
+    echo "UNPINNED ($1): $2"
+    fail=1
+}
+
+# 1. Compose files: image: lines with :latest or no tag at all
+while IFS= read -r match; do
+    report "compose" "$match"
+done < <(grep -Hn "image:" services/docker-compose*.yml 2>/dev/null \
+    | grep -v "#" \
+    | grep -E "image:[[:space:]]+(\S+:latest[[:space:]]*$|\S*/[^:]+[[:space:]]*$|[^/:]+[[:space:]]*$)" || true)
+
+# 2. :latest anywhere in shell or yaml under lib/, scripts/, services/
+while IFS= read -r match; do
+    report ":latest" "$match"
+done < <(grep -rn ":latest" lib/ scripts/ services/ \
+    --include="*.sh" --include="*.yml" 2>/dev/null \
+    | grep -v "^${SELF}:" \
+    | grep -v "localhost/" \
+    | grep -v "pin-waiver:" || true)
+
+# 3. FROM lines in heredoc Dockerfile templates without a version tag
+while IFS= read -r match; do
+    report "FROM" "$match"
+done < <(grep -rn "^FROM " lib/ scripts/ --include="*.sh" 2>/dev/null \
+    | grep -vE "^[^:]+:[0-9]+:FROM [^ ]+:[A-Za-z0-9][A-Za-z0-9._-]*([[:space:]]|$)" \
+    | grep -v "^${SELF}:" || true)
+
+# 4. Registry-prefixed references in shell code without a tag
+while IFS= read -r match; do
+    report "no tag" "$match"
+done < <(grep -rnE "(docker\.io|ghcr\.io|quay\.io)/[A-Za-z0-9._/-]+" \
+    lib/ scripts/ --include="*.sh" 2>/dev/null \
+    | grep -vE "(docker\.io|ghcr\.io|quay\.io)/[A-Za-z0-9._/-]+:[A-Za-z0-9]" \
+    | grep -v "^${SELF}:" || true)
+
+if [ "$fail" -eq 1 ]; then
+    echo "FAIL: unpinned container image references found"
+    exit 1
+fi
+
+echo "All container image references are pinned"
+exit 0
diff --git a/scripts/utils/setup-podman-rootless.sh b/scripts/utils/setup-podman-rootless.sh
@@ -409,7 +409,7 @@ verify_setup() {
   fi
 
   # Test basic container operation
-  if podman run --rm alpine:latest echo "test" >/dev/null 2>&1; then
+  if podman run --rm docker.io/library/alpine:3.24.1 echo "test" >/dev/null 2>&1; then
     log_info "${ICON_SUCCESS:-✅} Test container ran successfully"
   else
     log_error "${ICON_ERROR:-❌} Test container failed"
