fix(ci): stamp the checked-out commit on published images and attach an SBOM attestation - #1433
Merged
Merged
Conversation
…an SBOM attestation A workflow_dispatch republish of a tag runs the workflow from main, so github.sha was main's HEAD while the checkout was the tag's commit. The v0.7.3 image got GIT_COMMIT and org.opencontainers.image.revision = 8d64005 instead of the tagged 68e3f79, contradicting its own provenance attestation. - prepare resolves `git rev-parse HEAD` once; both builds use it for GIT_COMMIT and the revision label is overridden with it - fail the per-platform job if the pushed digest's revision label differs - set provenance: mode=max explicitly and add sbom: true Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
solarssk
added
type: bug
Owner
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
….3 exception Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…nto fix/publish-container-tag-sha
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Infra and release-pipeline change, no user-facing feature. Anyone checking where a published image came from (an operator reading the admin build info, an auditor comparing the image label with the provenance attestation) should get the commit that was actually built. For 0.7.3 they got a later commit: the tag-push run failed, the release was republished through
workflow_dispatch, and the image was stamped8d64005(main's HEAD) instead of the tagged68e3f79. The provenance attestation had the right commit, so the image contradicted its own attestation.Cause. A dispatch run executes the workflow file from main, so
github.shais main's HEAD, while the checkout usesinputs.ref(the tag).GIT_COMMIT(embedded in the admin SPA and shown in the health check) and theorg.opencontainers.image.revisionlabel (fromdocker/metadata-action) both readgithub.sha.Changes (
.github/workflows/publish-container.yml)prepareresolvesgit rev-parse HEADonce (shaoutput). Both build steps use it forGIT_COMMIT, and the metadata step overrides the revision label with it (custom labels win in metadata-action's last-value-wins merge).build-and-scan: pulls the pushed digest and fails if its revision label differs from the checked-out commit, so this cannot regress silently.provenance: mode=maxis now explicit (it was only the default because the repo is public).sbom: trueadds a BuildKit SBOM attestation to each per-platform image, so Docker Scout can read packages from the image. The Trivy CycloneDX file on the GitHub Release is unchanged.docs/wiki/Help-and-Troubleshooting.mdnow says what the sidebar's build commit means and notes the 0.7.3 exception (its footer shows8d64005).SECURITY.mdandARCHITECTURE-FOR-AUDITORS.mdmention the new attestation and the guard. CHANGELOG has Changed and Fixed entries.How to test
actionlint1.7.12 (the version CI pins) passes on the workflow.docker image inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}'template returns the label and that a--labelbuild flag overrides a DockerfileLABEL.docker buildx imagetools inspect docker.io/solarssk/admitto:0.7.4should show attestation manifests, and therevisionlabel must equal thev0.7.4tag's commit.What stays / known limitations
sbom: trueadds one more attestation manifest per platform. It could not be exercised before a real release.Documentation impact
Checklist
@example.comaddresses)npm test; optional:npm run coverageto match CI) - not applicable, workflow and docs only; checked with actionlint instead🤖 Generated with Claude Code