From b4406ab7553a27dfd6dac4c7dfb02676cbe2e2d6 Mon Sep 17 00:00:00 2001 From: RonaldHensbergen Date: Fri, 28 Aug 2026 21:27:28 +0200 Subject: [PATCH] docs: formalize images/ independent versioning boundary Adds an explicit /images/ CODEOWNERS entry and a Versioning section to docs/image-scanning.md documenting the existing publish-images.yml tag scheme as the authoritative release record for images, and pointing to tests/fixtures/signed-images.json for currently-published digests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/CODEOWNERS | 4 ++++ docs/image-scanning.md | 25 +++++++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 9adcee90..ab73990d 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -17,6 +17,10 @@ # Module definitions /modules/ @RonaldHensbergen @SemTiOne +# Runtime images (Dockerfiles, image-specific requirements). Versioned and +# released independently of the CLI - see docs/image-scanning.md#versioning. +/images/ @RonaldHensbergen @SemTiOne + # Profile definitions /profiles/ @RonaldHensbergen @SemTiOne diff --git a/docs/image-scanning.md b/docs/image-scanning.md index 9c771793..aa8a6a47 100644 --- a/docs/image-scanning.md +++ b/docs/image-scanning.md @@ -17,6 +17,31 @@ Because the images re-resolve pip ranges (`>=`) and OS packages at build time, a weekly rebuild refreshes base layers even when the pinned base image digest has not changed. +## Versioning + +Images under `images/` are versioned and released **independently of the +CLI**. The CLI's own version (`pyproject.toml`, `CHANGELOG.md`, `vX.Y.Z` git +tags) covers `cli/`, `modules/`, and `profiles/` only and says nothing about +which image tags are currently published. + +The tag scheme computed by `publish-images.yml`'s "Determine version" step is +the authoritative release record for images — there is no separate GitHub +Release object for them: + +- a base version derived from the pinned upstream dependency (`dagster==` + in `images/dagster/requirements.txt`, `FROM apache/superset:` in + `images/superset/base/Dockerfile`, `dbt-core==` in + `images/dbt/requirements.txt`), +- an optional `-` prefix for non-default image variants, +- plus a `sha-<12-char-commit-sha>` tag (immutable, always pushed) and a + `latest`/`latest` tag. + +To find the currently-published digest for a given image, look up +`tests/fixtures/signed-images.json`: it is refreshed automatically by the +`update-fixture` job in `publish-images.yml` after every successful publish +and records the repository, digest, and signing/attestation status for each +published image. + ## Remediation SLA | Severity | Remediation target |