Generate proxy image attestations - #241
JamieMagee wants to merge 4 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Production OIDC issuance and registry attestation still require validation through an authorized main-branch run.
Review tier: Balanced
Findings: None
What changed in this PR
Adds verifiable build provenance to GHCR image publication.
Changes:
- Publishes images by digest and attests them before tagging.
- Replaces the shell publisher with pinned actions.
- Documents verification and tests workflow invariants.
| File | Description |
|---|---|
.github/workflows/ghcr.yml |
Implements digest-based build, attestation, and tagging. |
ghcr_workflow_test.go |
Tests publication ordering and security constraints. |
README.md |
Documents provenance verification. |
script/cibuild-publish-ghcr |
Removes the superseded publisher. |
script/_common |
Removes the unused branch constant. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| These attestations cover newly built container images. The workflow does not backfill historical images. | ||
| Runtime verification in the CLI and Action, and attestations for the native CodeQL archives, are separate work. |
There was a problem hiding this comment.
This entire paragraph seems like it will go stale quickly so not worth including.
| function main() { | ||
| docker_build | ||
| push_to_ghcr |
There was a problem hiding this comment.
It took me a moment to realize that getting rid of this script does not prevent us from building this image locally for dev/testing purposes.
This only gets rid of publishing to GHCR manually, which is probably okay for us... there may be scenarios down the road where we want to manually publish an image to GHCR, for example from a specific branch.
From what I can see, we couldn't do that today through the GitHub Action, but that wouldn't be hard to add down the road if needed. I'm fine with delaying adding it until we actually need it.
What are you trying to accomplish?
Publish GitHub build provenance for proxy images so consumers can verify their source. Build and push both image tags in one step, then attest the returned digest in GitHub and GHCR.
Anything you want to highlight for special attention from reviewers?
Image tags are published before attestation. If attestation fails, the workflow skips Git tag creation and leaves the image tags published. This replaces the shell publisher with pinned Docker actions and
actions/attest. Local build/test behavior, platform support and tag formats stay unchanged.How will you know you've accomplished your goal?
YAML lint and shell checks passed. A local registry build published both image tags with the same digest. Live OIDC issuance still needs an authorized main-branch run. The complete test suite was not run.
Checklist