.ko.yaml references all three base images by tag only
(gcr.io/distroless/static-debian13, alpine, debian:stable-slim).
Two builds of the same commit can therefore produce different images
depending on when they run, and debian:stable-slim moves across Debian
majors on its own.
Proposal: pin each as image:tag@sha256:..., move alpine/debian to explicit
major tags (alpine:3.24, debian:13-slim) so a routine digest bump never
crosses a major, and add a hack/verify check so a tag-only ref fails
presubmit. A scheduled bump job is a follow-up.
Related: #1489 (Makefile image list), #1180 (GCR → AR).
.ko.yamlreferences all three base images by tag only(
gcr.io/distroless/static-debian13,alpine,debian:stable-slim).Two builds of the same commit can therefore produce different images
depending on when they run, and
debian:stable-slimmoves across Debianmajors on its own.
Proposal: pin each as
image:tag@sha256:..., move alpine/debian to explicitmajor tags (
alpine:3.24,debian:13-slim) so a routine digest bump nevercrosses a major, and add a
hack/verifycheck so a tag-only ref failspresubmit. A scheduled bump job is a follow-up.
Related: #1489 (Makefile image list), #1180 (GCR → AR).