Jepsen: Supply-chain harden the CI workflow

Pin everything the job fetches and builds so a CI run is reproducible
and a re-tagged or force-pushed upstream cannot change what executes.

- Pin the five container images (MinIO, mc, Toxiproxy, the Erlang broker
  base, the Clojure control base) by digest instead of mutable tags
- Pin the upstream rabbitmq-server clone to a commit SHA and
  shallow-fetch it directly, rather than building the streams-tiered-
  storage branch tip; bump the SHA periodically to track the branch
- Set persist-credentials: false on the plugin checkout so the
  GITHUB_TOKEN is not left in .git/config for the build, the lein
  dependency download and the cluster to read

The workflow already SHA-pins its actions and runs with
`permissions: contents: read`.

Author: the-mikedavis

.github/workflows/jepsen.yaml

@@ -70,10 +70,28 @@ jobs:
           otp-version: ${{ matrix.otp-version }}
           elixir-version: ${{ matrix.elixir-version }}
       - name: Clone rabbitmq-server
-        run: git clone --depth 1 --branch ${{ matrix.rmq-version }} https://github.com/amazon-mq/upstream-to-rabbitmq-server.git ${{ github.workspace }}/rabbitmq-server
+        # The server is built and run as part of the cluster, so pin it to a
+        # commit SHA rather than the mutable streams-tiered-storage branch tip:
+        # a CI run then builds exactly the server it was tested against, and a
+        # force-push to the branch cannot change what executes here. Bump this
+        # SHA periodically to track the branch (that re-introduces server-drift
+        # coverage at a controlled point). Shallow-fetch the SHA directly so the
+        # checkout keeps working once the branch tip has moved past the pin.
+        env:
+          RMQ_SERVER_SHA: 91051d3c678faa6cc68a75d6b561ceca05e12025
+        run: |
+          git init -q "${{ github.workspace }}/rabbitmq-server"
+          git -C "${{ github.workspace }}/rabbitmq-server" remote add origin \
+            https://github.com/amazon-mq/upstream-to-rabbitmq-server.git
+          git -C "${{ github.workspace }}/rabbitmq-server" fetch -q --depth 1 origin "$RMQ_SERVER_SHA"
+          git -C "${{ github.workspace }}/rabbitmq-server" checkout -q "$RMQ_SERVER_SHA"
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: rabbitmq-server/deps/rabbitmq_stream_s3
+          # The job then runs a full server build plus a lein dependency
+          # download and a RabbitMQ cluster; do not leave the token in .git/config
+          # for that third-party code to read.
+          persist-credentials: false
       - name: Run Jepsen
         working-directory: rabbitmq-server/deps/rabbitmq_stream_s3
         run: jepsen/ci/run-jepsen.sh

jepsen/docker/Dockerfile-control

@@ -1,7 +1,8 @@
 # Jepsen control node: runs `lein run test ...` and drives the DB nodes over
 # SSH. Needs a JDK (for the Stream Java client + jepsen), leiningen, and an
 # SSH client.
-FROM clojure:temurin-21-lein
+# Pinned by digest for supply-chain reproducibility (clojure:temurin-21-lein).
+FROM clojure@sha256:f5ef76151930464b31b97d518469b802de1c82507d6205d6ecf96cf6cb6d17d2
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         git openssh-client sshpass iputils-ping dnsutils gnuplot graphviz \

jepsen/docker/Dockerfile-node

@@ -2,7 +2,8 @@
 # plus the bits jepsen needs: sshd for control access and iptables/sudo for
 # the partition nemesis. The broker itself is installed at run time by db.clj
 # from /shared/rabbitmq.tar.xz (the generic-unix tarball).
-FROM erlang:27
+# Pinned by digest for supply-chain reproducibility (erlang:27).
+FROM erlang@sha256:b439336c5035e414008770118719907d08b12c23e576b34a5efc6516653de0f4
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         openssh-server sudo iproute2 iptables procps ca-certificates \

jepsen/docker/docker-compose.yml

@@ -52,7 +52,8 @@ services:
   n5: {<<: *node, hostname: n5, container_name: n5}
 
   minio:
-    image: minio/minio:latest
+    # Pinned by digest for supply-chain reproducibility (was minio/minio:latest).
+    image: minio/minio@sha256:14cea493d9a34af32f524e538b8346cf79f3321eff8e708c1e2960462bd8936e
     environment:
       MINIO_ROOT_USER: jepsenjepsen
       MINIO_ROOT_PASSWORD: jepsenjepsenjepsen
@@ -69,7 +70,8 @@ services:
       jepsen:
 
   toxiproxy:
-    image: ghcr.io/shopify/toxiproxy:latest
+    # Pinned by digest (was ghcr.io/shopify/toxiproxy:latest).
+    image: ghcr.io/shopify/toxiproxy@sha256:9378ed52a28bc50edc1350f936f518f31fa95f0d15917d6eb40b8e376d1a214e
     # The toxiproxy image is FROM scratch (no shell), so the passthrough proxy
     # is declared in a config file loaded at startup rather than created by an
     # init container. -host=0.0.0.0 exposes the admin API (8474) for S3 fault
@@ -91,7 +93,8 @@ services:
     # comes from MC_HOST_j, and we talk path-style to minio:443 with --insecure
     # (the cert is for *.s3.jepsen.local, not "minio"). restart: on-failure
     # retries until MinIO is accepting connections, then exits 0.
-    image: minio/mc:latest
+    # Pinned by digest (was minio/mc:latest).
+    image: minio/mc@sha256:a7fe349ef4bd8521fb8497f55c6042871b2ae640607cf99d9bede5e9bdf11727
     environment:
       MC_HOST_j: "https://jepsenjepsen:jepsenjepsenjepsen@minio:443"
     entrypoint: ["mc"]