Homelab CI/CD Supply Chain

Seven gates from commit to admission — measured against the live cluster, 2026-09-20 · Author: George Ezejiofor

Homelab CI/CD Supply Chain Seven gates from commit to admission — measured against the live cluster, 2026-09-20 · Author: George Ezejiofor 1 · GitHub Actions · self-hosted ARC runner · dind · Architecture component · ns arc-runners · no Istio sidecar 1 · GitHub Actions self-hosted ARC runner · dind ns arc-runners · no Istio sidecar 2 · SonarQube · pipeline step 2 · pre-build · namespace tekton-builds · qualitygate.wait=true 2 · SonarQube pipeline step 2 · pre-build qualitygate.wait=true 3 · Tekton PipelineRun · kaniko v1.23.2 · no Docker daemon · namespace tekton-builds · writes IMAGE_DIGEST 3 · Tekton PipelineRun kaniko v1.23.2 · no Docker daemon writes IMAGE_DIGEST 4 · Trivy 0.58.0 · scans the pushed digest · namespace tekton-builds · CRITICAL or HIGH fails the run 4 · Trivy 0.58.0 scans the pushed digest CRITICAL or HIGH fails the run 5 · Tekton Chains · x509 signer · namespace tekton-builds · simplesigning + in-toto SLSA 5 · Tekton Chains x509 signer simplesigning + in-toto SLSA 6 · Harbor · harbor.georgehomelab.com/library · Architecture component · image · .sig · .att · scan · SBOM · labels 6 · Harbor harbor.georgehomelab.com/library image · .sig · .att · scan · SBOM · labels ArgoCD · reconciles manifests · Architecture component ArgoCD reconciles manifests 7 · Kyverno verifyImages · ClusterPolicy · failureAction Enforce · Architecture component · mutateDigest true · :v1 → @sha256 7 · Kyverno verifyImages ClusterPolicy · failureAction Enforce mutateDigest true · :v1 → @sha256 Vault · secret/homelab/tekton/cosign · Architecture component Vault secret/homelab/tekton/cosign signing-secrets · chains-controller SA only · Architecture component signing-secrets chains-controller SA only Committed public key · no Rekor · no transparency log · Architecture component Committed public key no Rekor · no transparency log Code fails review · exit 3 — nothing is built · Architecture component Code fails review exit 3 — nothing is built CVE-bearing image · pushed but never signed — unrunnable · Architecture component CVE-bearing image pushed but never signed — unrunnable Unsigned image · REJECTED at admission · Architecture component Unsigned image REJECTED at admission triggers run gate passes digest clean .sig + .att image ref applies manifest kaniko push scans pushed digest VSO projects cosign key verifies .sig against committed key REFUSED REFUSED REFUSED namespace tekton-builds Legend Backend Database Cloud Security External

Who holds what

  • • The ARC runner triggers only — it never builds and never holds a registry credential
  • • kaniko builds with no Docker daemon and writes IMAGE_DIGEST
  • • Only the tekton-chains-controller ServiceAccount can read the cosign key

Three demonstrated refusals

  • • Stage 2 — code fails review, exit 3, nothing is built
  • • Stage 4 — CVE-bearing image is pushed but never signed, so it is unrunnable
  • • Stage 7 — unsigned image is REJECTED at admission

Trust root

  • • No Rekor, no transparency log, no Sigstore cloud
  • • Signatures verify against a committed public key
  • • Kyverno mutateDigest rewrites :v1 to the verified @sha256 at admission