Fold enforce-tag-immutability into harden-zot-registry #235

Merged

eblume merged 1 commit from enforce-tag-immutability into main

2026-02-21 08:05:17 -08:00

eblume commented

2026-02-21 07:53:42 -08:00

Owner

Summary

Removed status: active from enforce-tag-immutability card — its requirements are folded into the parent harden-zot-registry goal's accessControl configuration
Updated harden-zot-registry with three-tier access control spec (anonymous read, artifact-workloads read+create, admins full)
Added artifact-workloads group creation step to register-zot-oidc-client
Added service account context to wire-ci-registry-auth

Rationale

Tag immutability requires authentication to be meaningful. Without auth, everyone is anonymous and gets the same policy. Rather than client-side push checks, the registry enforces immutability server-side: CI gets ["read", "create"] (no update/delete), so pushing an existing tag is rejected by zot itself.

Test plan

mise run docs-check-links passes
mise run docs-mikado shows enforce-tag-immutability as resolved

## Summary - Removed `status: active` from `enforce-tag-immutability` card — its requirements are folded into the parent `harden-zot-registry` goal's `accessControl` configuration - Updated `harden-zot-registry` with three-tier access control spec (anonymous read, artifact-workloads read+create, admins full) - Added `artifact-workloads` group creation step to `register-zot-oidc-client` - Added service account context to `wire-ci-registry-auth` ## Rationale Tag immutability requires authentication to be meaningful. Without auth, everyone is anonymous and gets the same policy. Rather than client-side push checks, the registry enforces immutability server-side: CI gets `["read", "create"]` (no update/delete), so pushing an existing tag is rejected by zot itself. ## Test plan - [ ] `mise run docs-check-links` passes - [ ] `mise run docs-mikado` shows enforce-tag-immutability as resolved

eblume added 1 commit

2026-02-21 07:53:42 -08:00

Fold enforce-tag-immutability into harden-zot-registry b42660f881

Tag immutability requires auth to be meaningful, so it can't be resolved
independently. Replace client-side push checks with server-side
accessControl policy: artifact-workloads group gets read+create (no
update/delete), enforcing immutability at the registry level.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>