Context
Part of the FIPS-removal effort. See REMOVE_FIPS_PLAN.md for the full plan and premise.
Premise: Coder is not a FIPS boundary component; upstream LBs/proxies handle FIPS-validated TLS. We are removing the custom FIPS container image build pipelines.
Scope
Delete the two GitHub Actions workflows that exist solely to build and push FIPS images.
Files to delete
.github/workflows/coder-fips.yml — builds Coder with GOFIPS140=latest, tags -fips / latest-fips, pushes to ECR.
.github/workflows/images.yml — builds base-fips and desktop-fips workspace images, pushes to ECR.
Files to leave unchanged
.github/workflows/terraform.yml — runs fmt/validate/tflint/trivy. No FIPS content.
Acceptance criteria
Dependencies
None on other code units.
Follow-on
The GitHub repo secrets AWS_ROLE_ARN and ECR_REGISTRY used by these workflows will be orphaned after this merges. Their deletion is handled by the cleanup-fips-secrets.sh script issue (Issue 7 in the plan — committed, everything-as-code, not an operator checklist).
The aws_iam_role.github_actions IAM role that these workflows assumed is removed by the Terraform cleanup issue (Issue 3).
Context
Part of the FIPS-removal effort. See
REMOVE_FIPS_PLAN.mdfor the full plan and premise.Premise: Coder is not a FIPS boundary component; upstream LBs/proxies handle FIPS-validated TLS. We are removing the custom FIPS container image build pipelines.
Scope
Delete the two GitHub Actions workflows that exist solely to build and push FIPS images.
Files to delete
.github/workflows/coder-fips.yml— builds Coder withGOFIPS140=latest, tags-fips/latest-fips, pushes to ECR..github/workflows/images.yml— buildsbase-fipsanddesktop-fipsworkspace images, pushes to ECR.Files to leave unchanged
.github/workflows/terraform.yml— runs fmt/validate/tflint/trivy. No FIPS content.Acceptance criteria
ls .github/workflows/shows onlyterraform.yml.grep -rin fips .github/returns nothing.Dependencies
None on other code units.
Follow-on
The GitHub repo secrets
AWS_ROLE_ARNandECR_REGISTRYused by these workflows will be orphaned after this merges. Their deletion is handled by thecleanup-fips-secrets.shscript issue (Issue 7 in the plan — committed, everything-as-code, not an operator checklist).The
aws_iam_role.github_actionsIAM role that these workflows assumed is removed by the Terraform cleanup issue (Issue 3).