From c35c1f12c25b13497b4682cd48dddfe0667fba4b Mon Sep 17 00:00:00 2001 From: castrojo Date: Wed, 9 Sep 2026 20:03:25 -0400 Subject: [PATCH] fix(sec): pin argocd-server container image by digest Pin quay.io/argoproj/argocd:v2.12.3 to sha256:68894064bc381c19ea951029510aa614bd26bf46c2ec65ea445c7d8d095a9417 to guarantee image immutability and supply-chain integrity for control-plane GitOps manifests. Partially addresses #74. Assisted-by: Gemini 3.8 Flash via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- files/k0s/manifests/argocd/install.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/files/k0s/manifests/argocd/install.yaml b/files/k0s/manifests/argocd/install.yaml index ceb45af..d071671 100644 --- a/files/k0s/manifests/argocd/install.yaml +++ b/files/k0s/manifests/argocd/install.yaml @@ -41,7 +41,7 @@ spec: serviceAccountName: argocd-server containers: - name: argocd-server - image: quay.io/argoproj/argocd:v2.12.3 + image: quay.io/argoproj/argocd:v2.12.3@sha256:68894064bc381c19ea951029510aa614bd26bf46c2ec65ea445c7d8d095a9417 command: [argocd-server, --insecure, --staticassets, /shared/app] ports: - containerPort: 8080