Use datadog image registry for gitlab ci jobs#316
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d09241ee40
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| - "docker-in-docker:amd64" | ||
|
|
||
| image: maven:3.9-eclipse-temurin-17 | ||
| image: $REGISTRY/images/mirror/maven:3.9-eclipse-temurin-17 |
There was a problem hiding this comment.
For this manual release job, GitLab supports CI/CD variables in image and manual/pipeline variables have higher precedence than top-level .gitlab-ci.yml defaults, so a user who can start the job with variables can set REGISTRY=attacker.example and make the secret-fetching release job run from attacker.example/images/mirror/maven:.... Because the script then retrieves Sonatype credentials and the GPG private key from SSM, keep this image reference fixed to the trusted registry instead of using an externally overrideable variable.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
I guess this is a concern. Is there a reason we can't just hardcode $REGISTRY?
There was a problem hiding this comment.
Easier to maintain if this needs to change. Users with access to Gitlab to run the pipeline will likely have write access, I'm not sure this would actually protect us from anything.
2 participants
No description provided.