From 324d6bd3f66019db52365056bdcce56ab3f048e0 Mon Sep 17 00:00:00 2001 From: yucheng Date: Thu, 5 Nov 2026 19:07:46 -0800 Subject: [PATCH] ci: list the FIPS Dockerfile in the CI coverage allowlist No pull request job holds the Chainguard token its base image and apk repo need. --- .github/ci-coverage-allowlist.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/ci-coverage-allowlist.yml b/.github/ci-coverage-allowlist.yml index 5dffa78776d..b42f943def6 100644 --- a/.github/ci-coverage-allowlist.yml +++ b/.github/ci-coverage-allowlist.yml @@ -66,6 +66,12 @@ dockerfiles: An example image under cookbook/ that is documentation rather than a shipped artifact paths: - cookbook/litellm-ollama-docker-image/Dockerfile + - reason: >- + The FIPS image builds on the pinned cgr.dev/berri.ai chainguard-base-fips base and every apk + call authenticates to virtualapk.cgr.dev with a Chainguard token supplied as a build secret; + no pull request job holds that token, so no job can build it + paths: + - docker/Dockerfile.fips - reason: >- The Rust gateway image compiles the whole workspace in release mode, which is too slow for a per-pull-request job while the gateway binary is still being assembled; the Rust lint,