From c28a2e56c44ee05b38eb1ae4889fb1a0aee1ba62 Mon Sep 17 00:00:00 2001 From: Levi Figueira Date: Wed, 21 Oct 2026 22:29:59 +0100 Subject: [PATCH] fix: limit exact version pins to what a project builds from and runs Infrastructure and security guidance told agents to pin every version, so reviews flagged applications and tools that track a release channel on purpose. Pin lockfile packages, providers, the release toolchain and base images; let applications and tools installed for people or agents follow a documented upgrade policy, and flag a floating version only when none is documented. Pin the uv image in the Python Dockerfile example. Closes #411 --- CHANGELOG.md | 1 + content/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- .../skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- dist/amp/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- .../skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- dist/codex/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- .../skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- dist/cursor/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- .../skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- dist/opencode/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- .../skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- dist/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- dist/skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- plugins/loaf/skills/infrastructure-management/SKILL.md | 9 +++++---- .../skills/infrastructure-management/references/ci-cd.md | 3 ++- .../skills/python-development/references/deployment.md | 2 +- .../security-compliance/references/security-review.md | 3 ++- 29 files changed, 71 insertions(+), 49 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac0b540ec..c506b6544 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ This project follows [Common Changelog](https://common-changelog.org/) and [Sema - Write tracker issues and comments for people. Issues open with one to three plain sentences on where they came from, the problem and why it matters, followed by short `###` sections for Definition of Done, Out of Scope, Verification and Risks, leaving out empty ones. Detail only agents need moves into collapsed agent notes below a divider, with fixed labels and no status, dates, assignees or Loaf naming. Comments and Ship's review lead with one to three plain lines. Records link issues natively, write exact moments in UTC, point only to places everyone with tracker access can reach, and keep magic words in PR descriptions and commit messages. The GitHub and Linear skills describe each tracker's syntax, and migrated records keep their source marker in the agent notes instead of a visible line ([#391](https://github.com/levifig/loaf/issues/391)). - Ship confirms every Verification box on an issue is ticked before marking it Done or merging a PR that closes it, and does so before the merge because merging can close linked issues automatically; the merge hooks check the same boxes. An open box blocks closing and merging unless a reason from a person with authority over the work is written on it; a reason can defer only a check that cannot run before the merge or that only a person can do, and Ship reports that criterion as deferred rather than proven. Whoever ran a check ticks its box, an agent only after the check ran and its result is recorded; checks only a person can do stay for that person, and Implement hands off with the boxes it ran already ticked. Implement and Ship now declare that bounded body write in the Flow contract ([#392](https://github.com/levifig/loaf/issues/392)). +- Limit exact version pins to what a project builds from and runs: lockfile packages, including declared dev tools, providers, the release toolchain, and base images. Applications and tools installed for people or agents, such as agent CLIs and third-party images a project deploys, follow their own documented upgrade policy, which may be a release channel such as `latest`. Infrastructure guidance and the security review checklist flag a floating version only when no upgrade policy is documented, and the Python Dockerfile example now pins its `uv` image ([#411](https://github.com/levifig/loaf/issues/411)). ### Fixed diff --git a/content/skills/infrastructure-management/SKILL.md b/content/skills/infrastructure-management/SKILL.md index c9dbb0984..fdf066553 100644 --- a/content/skills/infrastructure-management/SKILL.md +++ b/content/skills/infrastructure-management/SKILL.md @@ -27,7 +27,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -35,7 +36,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -52,7 +53,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -60,7 +61,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/content/skills/infrastructure-management/references/ci-cd.md b/content/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/content/skills/infrastructure-management/references/ci-cd.md +++ b/content/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/content/skills/python-development/references/deployment.md b/content/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/content/skills/python-development/references/deployment.md +++ b/content/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/content/skills/security-compliance/references/security-review.md b/content/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/content/skills/security-compliance/references/security-review.md +++ b/content/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ``` diff --git a/dist/amp/skills/infrastructure-management/SKILL.md b/dist/amp/skills/infrastructure-management/SKILL.md index 4568af258..cf535cace 100644 --- a/dist/amp/skills/infrastructure-management/SKILL.md +++ b/dist/amp/skills/infrastructure-management/SKILL.md @@ -28,7 +28,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -36,7 +37,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -53,7 +54,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -61,7 +62,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/dist/amp/skills/infrastructure-management/references/ci-cd.md b/dist/amp/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/dist/amp/skills/infrastructure-management/references/ci-cd.md +++ b/dist/amp/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/dist/amp/skills/python-development/references/deployment.md b/dist/amp/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/dist/amp/skills/python-development/references/deployment.md +++ b/dist/amp/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/dist/amp/skills/security-compliance/references/security-review.md b/dist/amp/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/dist/amp/skills/security-compliance/references/security-review.md +++ b/dist/amp/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ``` diff --git a/dist/codex/skills/infrastructure-management/SKILL.md b/dist/codex/skills/infrastructure-management/SKILL.md index 4568af258..cf535cace 100644 --- a/dist/codex/skills/infrastructure-management/SKILL.md +++ b/dist/codex/skills/infrastructure-management/SKILL.md @@ -28,7 +28,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -36,7 +37,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -53,7 +54,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -61,7 +62,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/dist/codex/skills/infrastructure-management/references/ci-cd.md b/dist/codex/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/dist/codex/skills/infrastructure-management/references/ci-cd.md +++ b/dist/codex/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/dist/codex/skills/python-development/references/deployment.md b/dist/codex/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/dist/codex/skills/python-development/references/deployment.md +++ b/dist/codex/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/dist/codex/skills/security-compliance/references/security-review.md b/dist/codex/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/dist/codex/skills/security-compliance/references/security-review.md +++ b/dist/codex/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ``` diff --git a/dist/cursor/skills/infrastructure-management/SKILL.md b/dist/cursor/skills/infrastructure-management/SKILL.md index 4568af258..cf535cace 100644 --- a/dist/cursor/skills/infrastructure-management/SKILL.md +++ b/dist/cursor/skills/infrastructure-management/SKILL.md @@ -28,7 +28,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -36,7 +37,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -53,7 +54,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -61,7 +62,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/dist/cursor/skills/infrastructure-management/references/ci-cd.md b/dist/cursor/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/dist/cursor/skills/infrastructure-management/references/ci-cd.md +++ b/dist/cursor/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/dist/cursor/skills/python-development/references/deployment.md b/dist/cursor/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/dist/cursor/skills/python-development/references/deployment.md +++ b/dist/cursor/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/dist/cursor/skills/security-compliance/references/security-review.md b/dist/cursor/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/dist/cursor/skills/security-compliance/references/security-review.md +++ b/dist/cursor/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ``` diff --git a/dist/opencode/skills/infrastructure-management/SKILL.md b/dist/opencode/skills/infrastructure-management/SKILL.md index 4568af258..cf535cace 100644 --- a/dist/opencode/skills/infrastructure-management/SKILL.md +++ b/dist/opencode/skills/infrastructure-management/SKILL.md @@ -28,7 +28,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -36,7 +37,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -53,7 +54,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -61,7 +62,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/dist/opencode/skills/infrastructure-management/references/ci-cd.md b/dist/opencode/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/dist/opencode/skills/infrastructure-management/references/ci-cd.md +++ b/dist/opencode/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/dist/opencode/skills/python-development/references/deployment.md b/dist/opencode/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/dist/opencode/skills/python-development/references/deployment.md +++ b/dist/opencode/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/dist/opencode/skills/security-compliance/references/security-review.md b/dist/opencode/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/dist/opencode/skills/security-compliance/references/security-review.md +++ b/dist/opencode/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ``` diff --git a/dist/skills/infrastructure-management/SKILL.md b/dist/skills/infrastructure-management/SKILL.md index 3ee3e3374..7889740b0 100644 --- a/dist/skills/infrastructure-management/SKILL.md +++ b/dist/skills/infrastructure-management/SKILL.md @@ -27,7 +27,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -35,7 +36,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -52,7 +53,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -60,7 +61,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/dist/skills/infrastructure-management/references/ci-cd.md b/dist/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/dist/skills/infrastructure-management/references/ci-cd.md +++ b/dist/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/dist/skills/python-development/references/deployment.md b/dist/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/dist/skills/python-development/references/deployment.md +++ b/dist/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/dist/skills/security-compliance/references/security-review.md b/dist/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/dist/skills/security-compliance/references/security-review.md +++ b/dist/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ``` diff --git a/plugins/loaf/skills/infrastructure-management/SKILL.md b/plugins/loaf/skills/infrastructure-management/SKILL.md index 9e99065db..54d587c50 100644 --- a/plugins/loaf/skills/infrastructure-management/SKILL.md +++ b/plugins/loaf/skills/infrastructure-management/SKILL.md @@ -30,7 +30,8 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Use multi-stage builds to minimize image size - Run containers as non-root user (UID 1000) - Include health checks in all services -- Pin specific image versions (no `:latest`) +- Pin what the project builds from and runs: lockfile packages, providers, the release toolchain, and base images (a specific version, never `:latest`) +- Let applications and tools installed for people or agents, including third-party images the project deploys, follow their documented upgrade policy, which may be a release channel such as `latest` - Set resource requests AND limits - Use `npm ci` / `pip-sync` in CI (not install) - Commit lockfiles to version control @@ -38,7 +39,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an ### Never - Commit secrets to version control -- Use `:latest` tags in production +- Build from a `:latest` base image, or deploy a `:latest` image that has no documented upgrade policy - Skip security scanning in CI - Deploy without rollback capability - Store state in containers @@ -55,7 +56,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an - Check for common issues: - Missing resource limits/requests (CPU, memory) - Missing liveness/readiness probes - - Using `:latest` tag (prefer specific versions) + - A `:latest` tag on an image with no documented upgrade policy - Privileged containers (security concern) - No namespace specified - If `kubesec` is available: `kubesec scan {manifest}` @@ -63,7 +64,7 @@ Infrastructure patterns for containerization, orchestration, CI/CD pipelines, an **Dockerfiles:** - Check for: - Non-root USER specified - - Specific image versions (no `:latest`) + - Base and build-stage images at a specific version (no `:latest`) - HEALTHCHECK instruction - No secrets in ENV instructions - Using COPY instead of ADD for local files diff --git a/plugins/loaf/skills/infrastructure-management/references/ci-cd.md b/plugins/loaf/skills/infrastructure-management/references/ci-cd.md index cc6d6c91a..ec346d30c 100644 --- a/plugins/loaf/skills/infrastructure-management/references/ci-cd.md +++ b/plugins/loaf/skills/infrastructure-management/references/ci-cd.md @@ -39,7 +39,8 @@ Key conventions: - Tests run with real database services (Postgres 17) - Build step only runs on `main` branch - Use `npm ci` (not `npm install`) for lockfile fidelity -- Pin tool versions exactly in lockfiles +- Pin dependencies exactly through the committed lockfile, including dev tools such as linters that the project declares +- Tools installed on a machine for people or agents, such as agent CLIs, aren't project dependencies; they follow their own documented upgrade policy ## Caching Strategies diff --git a/plugins/loaf/skills/python-development/references/deployment.md b/plugins/loaf/skills/python-development/references/deployment.md index 1e2e10ebf..982f052a8 100644 --- a/plugins/loaf/skills/python-development/references/deployment.md +++ b/plugins/loaf/skills/python-development/references/deployment.md @@ -16,7 +16,7 @@ Multi-stage build with uv, non-root user: ```dockerfile FROM python:3.12-slim as builder WORKDIR /build -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.13.4 /uv /usr/local/bin/uv COPY pyproject.toml uv.lock ./ RUN uv sync --frozen --no-dev --no-install-project diff --git a/plugins/loaf/skills/security-compliance/references/security-review.md b/plugins/loaf/skills/security-compliance/references/security-review.md index 752373040..96e614324 100644 --- a/plugins/loaf/skills/security-compliance/references/security-review.md +++ b/plugins/loaf/skills/security-compliance/references/security-review.md @@ -50,7 +50,8 @@ For every PR: [ ] Default credentials changed [ ] Error messages don't leak internals [ ] Security headers configured (X-Content-Type-Options, X-Frame-Options, HSTS, CSP) -[ ] Dependencies pinned to specific versions +[ ] Project dependencies pinned to specific versions through a committed lockfile +[ ] Applications and tools that track a release channel have a documented upgrade policy [ ] Dependency scanning in CI [ ] Unnecessary features disabled ```