Two pre-existing hardening items raised by CodeRabbit on the promotion pull request (#556) and deferred out of it, since neither is introduced by that promotion and both want their own change.
The four lint task containers mount the workspace writable
.vscode/tasks.json lines 123, 134, 145 and 156 each run a :latest container with -v "${workspaceFolder}:/..." and no :ro:
| Task |
Image |
Mount |
| Lint: EditorConfig |
mstruebing/editorconfig-checker:latest |
${workspaceFolder}:/check |
| Lint: Workflows |
rhysd/actionlint:latest |
${workspaceFolder}:/repo |
| Lint: Markdown |
davidanson/markdownlint-cli2:latest |
${workspaceFolder}:/workdir |
| Lint: Spelling |
ghcr.io/streetsidesoftware/cspell:latest |
${workspaceFolder}:/workdir |
All four are read-only checks: none is invoked with a fix or write flag. So :ro on each mount costs nothing and removes the case where a changed or compromised :latest image can write to the working tree or to .git.
Worth doing, and worth doing deliberately rather than in a promotion: markdownlint-cli2 gains a --fix mode that a future task might reasonably want, and that task would then need its own writable mount rather than inheriting one silently.
The digest-pinning half of the finding is a separate question and probably a decline. CodeRabbit also suggested pinning each image to a reviewed digest. --pull=always on :latest for these tasks was a deliberate choice (#505), the images are not Dependabot-tracked, and pinning them by digest would mean a manual bump per image with no signal when one is stale. Raising it here so the reasoning is recorded rather than re-litigated.
The review-runbook GraphQL queries are unpaginated
.github/copilot-instructions.md line 50 uses reviews(first: 50) and lines 89-90 select last from a REST response without --paginate. On a pull request with a long review history the newest formal review can fall outside the window, so the runbook's own evidence query can report an older round as the current one.
This file is carried at intent fidelity, so it can be fixed locally, but the same text is in the hub canonical and every other fleet repo carries it. Worth fixing at the hub instead, or at least raising there first, so the fix reaches all of them rather than diverging this copy.
Neither of these blocks the promotion: the lint tasks are developer-local and the runbook queries are an agent aid, and both are exactly as they were before the resync.
Two pre-existing hardening items raised by CodeRabbit on the promotion pull request (#556) and deferred out of it, since neither is introduced by that promotion and both want their own change.
The four lint task containers mount the workspace writable
.vscode/tasks.jsonlines 123, 134, 145 and 156 each run a:latestcontainer with-v "${workspaceFolder}:/..."and no:ro:mstruebing/editorconfig-checker:latest${workspaceFolder}:/checkrhysd/actionlint:latest${workspaceFolder}:/repodavidanson/markdownlint-cli2:latest${workspaceFolder}:/workdirghcr.io/streetsidesoftware/cspell:latest${workspaceFolder}:/workdirAll four are read-only checks: none is invoked with a fix or write flag. So
:roon each mount costs nothing and removes the case where a changed or compromised:latestimage can write to the working tree or to.git.Worth doing, and worth doing deliberately rather than in a promotion:
markdownlint-cli2gains a--fixmode that a future task might reasonably want, and that task would then need its own writable mount rather than inheriting one silently.The digest-pinning half of the finding is a separate question and probably a decline. CodeRabbit also suggested pinning each image to a reviewed digest.
--pull=alwayson:latestfor these tasks was a deliberate choice (#505), the images are not Dependabot-tracked, and pinning them by digest would mean a manual bump per image with no signal when one is stale. Raising it here so the reasoning is recorded rather than re-litigated.The review-runbook GraphQL queries are unpaginated
.github/copilot-instructions.mdline 50 usesreviews(first: 50)and lines 89-90 selectlastfrom a REST response without--paginate. On a pull request with a long review history the newest formal review can fall outside the window, so the runbook's own evidence query can report an older round as the current one.This file is carried at
intentfidelity, so it can be fixed locally, but the same text is in the hub canonical and every other fleet repo carries it. Worth fixing at the hub instead, or at least raising there first, so the fix reaches all of them rather than diverging this copy.Neither of these blocks the promotion: the lint tasks are developer-local and the runbook queries are an agent aid, and both are exactly as they were before the resync.