feat(repos): declare ubi9-gitlab and ubi9-jenkins container image repos - #63
Open
NWarila wants to merge 1 commit into
Open
feat(repos): declare ubi9-gitlab and ubi9-jenkins container image repos#63NWarila wants to merge 1 commit into
NWarila wants to merge 1 commit into
Conversation
Adds two hardened container image repositories following the established ubi9-* convention alongside ubi9-hashicorp-vault and ubi9-aws-signing-helper. These are distinct from the existing gitlab and jenkins deploy repos: those carry the Ansible/Terraform deployment of the products, while these build and publish the OCI images.
NWarila
added a commit
that referenced
this pull request
Sep 1, 2026
Wires `aws_plan_role_arn` so pull-request plan runs assume
`nwarila-platform_github-terraform-runner_planner` — read-only on the
state key and the
private repo definitions — instead of the state-writing runner role.
## New IAM (already applied)
| role | trust | policies |
|---|---|---|
| `_runner` | OIDC, `sub` pinned to `ref:refs/heads/main` | `_runner_s3`
|
| `_planner` | OIDC, `sub` pinned to `:pull_request` | `_planner_s3` |
| `_admin` | SSO broker, 16-char suffix | `_runner_s3` + `_admin_s3` |
Documents are in `_handoff/iam-{roles,policies}/`. Audited independently
by two models;
`_admin_s3` is strictly additive over `_runner_s3` (zero identical
action+resource+condition
triples), and all policies use implicit deny only.
## ⚠️ TEST PIN — do not merge as-is
The framework pin points at the **#98 branch head** (`4fd428d`), not a
merged main SHA.
`plan_only` only reads real state under #98, and the planner role only
has a job under that
behaviour — so the two must land together. Sequence: merge framework
#98, then repoint this
pin at the resulting main SHA, then merge.
## What this run proves
This PR's own plan run exercises the planner role end to end:
1. `job_workflow_ref` resolves as expected for a **reusable** workflow
call — the wildcard
condition `...reusable-terraform-deploy.yaml@*` was unverifiable
beforehand, and this is the
safe place to find out, since a plan failure changes nothing.
2. The read-only policy is sufficient for `terraform init` + `plan
-lock=false`.
3. The plan is a **faithful diff** — it should show far fewer than the
89 creates that
reconstruction-from-adoption produced on #63.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Declares two hardened container image repositories following the established
ubi9-*convention, alongsideubi9-hashicorp-vaultandubi9-aws-signing-helper.ubi9-gitlabubi9-jenkinsThese are distinct from the existing
gitlabandjenkinsrepos: those carry theAnsible/Terraform deployment of the products, while these build and publish the images.
Plan review
Plan-only mode uses synthetic state, so existing resources show as noisy creates/updates.
Review for the two intended creates and for zero deletes/replaces.
Apply
Merging does not apply. After merge, dispatch: