Repository navigation
ci(security): run the image verifier liveness check daily - #3782
Conversation
The refusal probe observed a matched unsigned image being refused at the node pull layer while a signed control pulled (run 34777101451), so the liveness and signature-inventory checks now have a meaningful verdict. Restore their daily schedule at 04:43 UTC, the quietest hour for merge-queue deploys, and keep workflow_dispatch. Add an ablated trigger-set test, wired into the required validate job, that fails if the schedule is dropped or made non-daily, workflow_dispatch is removed, another trigger is added, a job gains a condition that would skip the scheduled run, or a job loses environment: prod. Part of #3336 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The Talos image verification patch still said a refused pull had never been observed, and the liveness workflow header still framed the signature inventory as deciding whether activation is safe. The probe in #3336 observed the refusal on a production node on 2026-09-13, so both comments now describe the current state. Comments only; no rule or value changes. Part of #3336 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@coderabbitai full review |
|
|
|
Warning Review limit reachedNext included review available in 5 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness at
|
Why
The check that node image signature enforcement is still working only ran when someone started it by hand. The refusal probe has now shown a real node refusing an unsigned image while pulling a signed one, so a daily run gives a meaningful regression signal instead of noise.
What
Runs the liveness check and the signature inventory every day at 04:43 UTC, the quietest hour for production deploys. They can still be started by hand. A new test in the required CI job fails if the daily run is removed, made less frequent, or skipped by a job condition.
Operational note: the issue stays open until the first scheduled run after merge is green.
Part of #3336
🤖 Generated with Claude Code