feat(supply-chain): add four composable reusable workflows#234
Conversation
Author the shared trust core for the container supply-chain overhaul (P2 of the homelab-infra plan v2.1 / ADR-012). These are workflow_call reusable workflows, INERT until caller repos are wired in P3; nothing calls them yet. - supply-chain-mirror-verify: resolve upstream digest + fail-closed cosign verify of the upstream signer (refuses empty/'.*' identity, RT-6); digest shape-guard (RT-11). No public push. - supply-chain-build-verify: A4 build-path gates (every FROM digest-pinned and in the approved-lock, uv.lock freshness, build-secret policy) then buildx to a local tar. No push, no sign. - supply-chain-promote-core: scan job (Trivy+Snyk on a local tar) gates the publish job, so nothing unscanned reaches public GHCR (RT-4); SBOMs via syft archive mode with no docker.sock (RT-8); cosign sign+attest+provenance; lock write without [skip ci] so the validator runs (RT-10). - supply-chain-consume-verify: downstream B6 gate; cosign verify against the expected identity (never wildcard) + optional lock membership; warn->enforce via an enforce input. All four pass yamllint, parse clean, no em-dashes, actions SHA-pinned, inputs passed via env. #VERIFY markers flag values to confirm at wire-time (real DHI/ distroless Fulcio identities, snyk docker-archive support, uv install method). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughFour reusable supply-chain workflows are added for upstream digest verification, Dockerfile build verification, consumer-side provenance checks, and scan/publish promotion. ChangesSupply Chain Pipeline Workflows
Estimated code review effort🎯 5 (Critical) | ⏱️ ~120 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/supply-chain-build-verify.yml:
- Around line 83-85: The workflow is exposing a runner-local tar path through
the local_tar output, but downstream promotion expects an artifact name it can
download. Update the build/publish flow in the supply-chain workflow so the
built image tar is uploaded with actions/upload-artifact, then change the
exposed output from jobs.build.outputs.local_tar to an artifact-name output such
as source_artifact that callers can pass into the promote workflow’s oci-tar
path. Use the existing build/publish job steps and outputs to locate the change.
- Around line 90-91: The workflow-level permissions are too broad because
supply-chain-build-verify.yml sets contents: read globally instead of using
empty permissions. Update the top-level permissions block in this workflow to
permissions: {} and keep the explicit contents: read permission on the job-level
section so the existing job configuration remains unchanged.
- Around line 202-210: The uv.lock gate step currently pipes a remote installer
directly into sh, which should be replaced with a safer install flow. Update the
workflow step in the uv.lock gate job to use astral-sh/setup-uv pinned to a
specific SHA, or explicitly download and verify the installer before executing
it; keep the same UV_VERSION/build_context behavior while removing the curl | sh
pattern.
In @.github/workflows/supply-chain-consume-verify.yml:
- Around line 113-138: The `Lock membership` step only warns in WARN mode, but
its failure state is not carried into the `verified` output, so `verified` can
still become true even when the lock check failed. Update the workflow wiring
around `verified` so the lock-check result is included in the final success
condition, and make the output false whenever `LOCK_FILE` is missing or `DIGEST`
is absent while `enforce=false`. Apply the same propagation logic in the related
`signature verification` and `verified` output steps so the final contract
remains “true only when all checks passed.”
- Around line 49-53: The default for expected_issuer_regexp is currently treated
as a loose regex, so update the workflow input to use an anchored and escaped
issuer pattern, and add the same empty/.* validation guard used by
expected_identity_regexp. Make the change in the expected_issuer_regexp
definition so the issuer match only accepts the exact GitHub OIDC issuer and
rejects broad values.
In @.github/workflows/supply-chain-mirror-verify.yml:
- Around line 90-91: The workflow-level permissions are too broad in the
supply-chain mirror verify workflow; update the top-level permissions to be
empty and keep the explicit `contents: read` permission only on the existing
job. Make this change in the workflow definition where `permissions` is declared
so it follows the repo guideline of `permissions: {}` at the workflow level and
job-scoped permissions in the job block.
- Around line 171-174: The `verified` output in the `supply-chain-mirror-verify`
workflow is inconsistent with its stated contract in the `REQUIRE` bypass
branch. Update the `verified` value written to `GITHUB_OUTPUT` in this branch to
match the description that verification is considered successful when not
required, or adjust the output description if that is the intended behavior; use
the existing `verified` output handling in this workflow step as the place to
fix it.
- Around line 147-160: The `SOURCE_REF` value is written to `GITHUB_OUTPUT`
without validating `UPSTREAM_REGISTRY` and `UPSTREAM_NAME`, so control
characters or newlines could inject extra output lines. Add a shape/character
whitelist check in the same step before `echo "source_ref=..."` that rejects
unsafe registry/name values, and only construct `SOURCE_REF` after both inputs
pass validation; keep the existing digest guard in place and use the existing
`SOURCE_DIGEST`, `SOURCE_REF`, and `GITHUB_OUTPUT` flow.
In @.github/workflows/supply-chain-promote-core.yml:
- Around line 120-122: The workflow-level permissions are too broad; update the
top-level permissions in the supply-chain promote workflow to be empty, since
each job already sets its own explicit permissions. Locate the workflow’s root
permissions block and replace the current contents with an empty workflow-level
permissions declaration, while leaving the job-level permissions unchanged.
- Around line 152-163: In the Materialize candidate step of
supply-chain-promote-core.yml, the registry branch in the run script currently
accepts any source_ref and can pull mutable tags; tighten the validation in this
block around SOURCE_KIND, SOURCE_REF, and the crane pull call so registry
sources must match a digest-pinned ref like `@sha256`:<64hex>. Add a clear error
and exit before crane pull when source_ref is missing or not digest-formatted,
ensuring only verified immutable registry references can be promoted.
- Around line 192-202: The Snyk gate step currently installs an unpinned CLI
with npm install -g snyk and masks install failures with || true, making the
workflow nondeterministic. Update the Snyk gate in the supply-chain-promote-core
workflow to install a fixed snyk@<version> instead of the latest release, and
remove the failure masking so the step fails if the install or scan cannot run.
Keep the existing snyk container test invocation and threshold handling
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0c30a9e4-3a38-4c3b-a917-11f6844f0cfb
📒 Files selected for processing (4)
.github/workflows/supply-chain-build-verify.yml.github/workflows/supply-chain-consume-verify.yml.github/workflows/supply-chain-mirror-verify.yml.github/workflows/supply-chain-promote-core.yml
| expected_issuer_regexp: | ||
| description: 'Regexp the OIDC issuer MUST match' | ||
| type: string | ||
| required: false | ||
| default: 'https://token.actions.githubusercontent.com' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the current issuer regexp is unanchored and has wildcard dots.
python3 - <<'PY'
import re
pattern = "https://token.actions.githubusercontent.com"
for issuer in [
"https://token.actions.githubusercontent.com",
"https://tokenXactionsYgithubusercontentZcom",
"prefix-https://token.actions.githubusercontent.com-suffix",
]:
print(f"{issuer}: {bool(re.search(pattern, issuer))}")
PY
rg -n -C3 'expected_issuer_regexp|certificate-oidc-issuer-regexp|case "\$ISSUER"' .github/workflows/supply-chain-consume-verify.ymlRepository: ByronWilliamsCPA/.github
Length of output: 1502
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the relevant workflow sections around the issuer input and validation.
sed -n '40,190p' .github/workflows/supply-chain-consume-verify.yml | cat -n
# Search for any other issuer-regexp handling in this workflow.
rg -n 'expected_issuer_regexp|certificate-oidc-issuer-regexp|ISSUER|expected_identity_regexp|certificate-identity-regexp' .github/workflows/supply-chain-consume-verify.ymlRepository: ByronWilliamsCPA/.github
Length of output: 7111
Anchor the issuer regexp and reject broad values.
https://token.actions.githubusercontent.com is treated as a regex here, so the unescaped dots and missing anchors can match unintended issuers. Switch the default to an anchored, escaped pattern and add the same empty/.* guard used for expected_identity_regexp.
Suggested tightening
expected_issuer_regexp:
description: 'Regexp the OIDC issuer MUST match'
type: string
required: false
- default: 'https://token.actions.githubusercontent.com'
+ default: '^https://token\.actions\.githubusercontent\.com$' case "$IDENTITY" in
""|".*"|"^.*$"|"^.*"|".*$")
echo "::error::expected_identity_regexp must be a specific pattern, not empty or '.*'"
exit 1
;;
esac
+
+ case "$ISSUER" in
+ ""|".*"|"^.*$"|"^.*"|".*$")
+ echo "::error::expected_issuer_regexp must be a specific pattern, not empty or '.*'"
+ exit 1
+ ;;
+ esac🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/supply-chain-consume-verify.yml around lines 49 - 53, The
default for expected_issuer_regexp is currently treated as a loose regex, so
update the workflow input to use an anchored and escaped issuer pattern, and add
the same empty/.* validation guard used by expected_identity_regexp. Make the
change in the expected_issuer_regexp definition so the issuer match only accepts
the exact GitHub OIDC issuer and rejects broad values.
PR Review: feat(supply-chain): add four composable reusable workflows
Agents run: A (CLAUDE.md), B (Bug scan), I (Security), J (PR desc vs diff), M (Premise gate) + CodeRabbit (11 inline comments) Critical (must fix before merge)[B, J, CodeRabbit] [M] [B, J, CodeRabbit] [M] PR description: ADR-012 does not exist. The PR body cites ADR-012 as design authority. Important (should fix)[B, I, CodeRabbit] [I, CodeRabbit] [I] [B, CodeRabbit] [B, CodeRabbit] [I, CodeRabbit] [A, CodeRabbit] [A] [J, CodeRabbit] [CodeRabbit] Copilot review requested; see Reviewers section for results. 🤖 Generated with Claude Code |
…match
The build-verify workflow wrote image.tar to the local runner filesystem and
exposed it as local_tar, but promote-core runs on a separate runner and can
never read a path from another runner's disk. Add an actions/upload-artifact
step so the built tar is accessible cross-runner.
Changes:
- Add Upload built image tar step (actions/upload-artifact, retention-days: 1)
- Add artifact_name output (build-<image_id>-tar) to job and workflow outputs
- Write artifact_name to GITHUB_OUTPUT inside the build step
- Fix header comment example: local_tar (broken) -> source_kind: oci-tar +
source_artifact: needs.build.outputs.artifact_name (correct)
- Change workflow-level permissions from contents: read to {} (jobs that need
permissions set them explicitly in their own permissions block)
- Add fail-closed uv installer checksum gate: UV_INSTALLER_SHA256 must be set
before callers are wired; exits 1 with instructions if the variable is empty
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes a collection of security and correctness gaps across promote-core,
consume-verify, and mirror-verify.
supply-chain-promote-core.yml:
- Fix Snyk dead gate: if: env.SNYK_TOKEN != '' evaluated step-level env which
GHA never exposes to if: expressions; Snyk never ran. Add check-snyk-token
step writing has-token to step outputs and gate on steps output (correct).
- Pin Snyk CLI to SNYK_CLI_VERSION; remove || true output suppression.
- Add masking for AUTH_B64 and AUTH_HEADER after GH_TOKEN masking; the log
scrubber masks exact strings only and does not redact base64 derivatives.
- Add source_ref digest shape-guard before crane pull to enforce the verified
digest trust model (rejects mutable tags).
- Add lock_file path traversal guard before any git operations on the file.
- Change workflow-level permissions from contents: read to {}.
- Add CRITICAL RAD marker on the Trivy re-introduction (Trivy was removed in
PR #229 due to confirmed supply-chain compromise; this re-introduction requires
ADR-012 and documented re-vetting before merge -- human action required).
supply-chain-consume-verify.yml:
- Propagate lock membership failure to the verified output in WARN mode: a
digest not in the lock wrote only a warning and exited 0, then cosign could
write verified=true, masking the lock failure. Now lock-check step outputs
lock_passed; verify step demotes verified to false when lock failed.
- Fix expected_issuer_regexp default to anchored and dot-escaped form; an
unescaped dot matched any character in the issuer URL.
supply-chain-mirror-verify.yml:
- Fix semantic inversion: when require_upstream_signature=false the output
contract documents true when verified OR not required, but code wrote
verified=false. Change to verified=true.
- Add UPSTREAM_REGISTRY and UPSTREAM_NAME shape-guards before GITHUB_OUTPUT
writes to prevent newline injection into the output file.
- Fix expected_issuer_regexp default to anchored and dot-escaped form.
- Change workflow-level permissions from contents: read to {}.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
/pr-fix summary
Three signed commits pushed to this branch (`29dd958`, `fd0fd9f`, `3f41d85`). All 15 auto-fixable issues resolved. Critical (auto-fixed)[build-verify] Interface mismatch — image.tar cannot cross runners
Important (auto-fixed)[promote-core] Snyk gate was dead code
[promote-core] BASE64 derivatives of masked secrets not redacted The log scrubber masks literal strings only; [promote-core] source_ref shape-guard missing before crane pull
[promote-core] lock_file path traversal
[consume-verify] lock failure masked in WARN mode When
[mirror-verify] verified=false semantic inversion when not required Output description: "true when the upstream signature verified or verification was not required." Code wrote [mirror-verify] UPSTREAM_REGISTRY/NAME GITHUB_OUTPUT injection Both inputs are caller-controlled and were written to [consume-verify, mirror-verify] Unanchored issuer regexp default Default [build-verify] uv installer piped to sh without checksum Crane (in the same file) verifies SHA256 before extraction; the uv installer did not. Added [build-verify, promote-core, mirror-verify] workflow-level permissions too broad Three files had Human-only items (no code change; author action required)[CRITICAL] Trivy supply-chain regression PR #229 (
[Important] ADR-012 cited but does not exist
[Suggested] SSRF via registry input (by design)
|
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/supply-chain-promote-core.yml (1)
229-234: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winSanitize the promote handoff artifact name.
actions/upload-artifactrejects characters like/and:inname, andinputs.image_idis caller-controlled here. Derive a safe slug/hash once and use that for the artifact name.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/supply-chain-promote-core.yml around lines 229 - 234, The artifact name in the “Hand the scanned tar to publish” upload step is built directly from caller-controlled inputs and can include invalid characters like / or :. Update the workflow to sanitize or slug/hash inputs.image_id once in the promote job, then use that safe value in actions/upload-artifact’s name field so the handoff artifact always has a valid name.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/supply-chain-build-verify.yml:
- Around line 211-226: Populate UV_INSTALLER_SHA256 in the
supply-chain-build-verify workflow before any caller can use require_uv_lock,
because the current empty value causes the UV installer checksum guard in the
run block to exit immediately. Update the UV_INSTALLER_SHA256 environment value
with the real sha256 for the current UV_VERSION, and make sure it is regenerated
whenever UV_VERSION changes so the workflow can proceed past the checksum check.
- Around line 292-302: The artifact naming in the build upload step uses
inputs.image_id directly, which can include invalid characters for
actions/upload-artifact. Update the build step that sets GITHUB_OUTPUT to derive
a single sanitized slug from IMAGE_ID (for example in the step that already
emits artifact_name), then reuse that output in the Upload built image tar step
instead of build-${{ inputs.image_id }}-tar so the artifact name is always
valid.
In @.github/workflows/supply-chain-mirror-verify.yml:
- Around line 68-70: The verification flow still allows a caller-controlled
expected_issuer_regexp, which can weaken cosign verification when signatures are
required. In the workflow logic that uses the issuer override, add the same
fail-closed validation used for IDENTITY so empty or wildcard issuer values are
rejected before verification proceeds. Update the relevant verification step
around the issuer handling to ensure only a strict, anchored issuer is accepted
when signatures are enforced.
In @.github/workflows/supply-chain-promote-core.yml:
- Around line 388-394: The LOCK_FILE validation in the workflow still allows
path traversal because the current regex admits embedded .. segments such as
locks/../.github/workflows/publish.yml. Update the LOCK_FILE guard in the
validation block to explicitly reject any value containing .. before it is
passed to the updater or git add, while keeping the existing repo-relative YAML
path checks in place.
- Line 225: The Snyk CLI install in the workflow currently uses npm install -g,
which can execute the package’s lifecycle scripts during setup. Update the
install step in the supply-chain promote workflow to use a reviewed method that
suppresses lifecycle hooks, or explicitly document why allowing the postinstall
hook is safe here. Keep the change focused around the Snyk installation step and
the SNYK_CLI_VERSION reference.
- Around line 181-187: The Trivy gate in the workflow reintroduces a pre-publish
blocker before ADR-012 approval is documented. Update the Trivy gate step to use
the vetted scanner path already established by the PR `#229` cutover (or otherwise
keep it disabled) until re-approval is recorded, and ensure the job definition
around the Trivy gate is aligned with the approved supply-chain scanning policy.
---
Outside diff comments:
In @.github/workflows/supply-chain-promote-core.yml:
- Around line 229-234: The artifact name in the “Hand the scanned tar to
publish” upload step is built directly from caller-controlled inputs and can
include invalid characters like / or :. Update the workflow to sanitize or
slug/hash inputs.image_id once in the promote job, then use that safe value in
actions/upload-artifact’s name field so the handoff artifact always has a valid
name.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 0834b861-2649-4d20-8cdc-4c1c8d4b7295
📒 Files selected for processing (5)
.github/workflows/supply-chain-build-verify.yml.github/workflows/supply-chain-consume-verify.yml.github/workflows/supply-chain-mirror-verify.yml.github/workflows/supply-chain-promote-core.ymlCHANGELOG.md
✅ Files skipped from review due to trivial changes (1)
- CHANGELOG.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/supply-chain-consume-verify.yml
| # #CRITICAL: set UV_INSTALLER_SHA256 to the sha256 of the installer | ||
| # for this UV_VERSION before wiring callers. Obtain it with: | ||
| # curl -fsSL "https://astral.sh/uv/${UV_VERSION}/install.sh" | sha256sum | ||
| # #VERIFY regenerate when bumping UV_VERSION. | ||
| UV_INSTALLER_SHA256: "" | ||
| run: | | ||
| set -euo pipefail | ||
| if [ -z "${UV_INSTALLER_SHA256}" ]; then | ||
| echo "::error::UV_INSTALLER_SHA256 must be set before this workflow is wired." | ||
| echo "::error::Run: curl -fsSL \"https://astral.sh/uv/${UV_VERSION}/install.sh\" | sha256sum" | ||
| exit 1 | ||
| fi | ||
| curl --fail --show-error --silent --location \ | ||
| "https://astral.sh/uv/${UV_VERSION}/install.sh" -o uv_install.sh | ||
| echo "${UV_INSTALLER_SHA256} uv_install.sh" | sha256sum --check | ||
| sh uv_install.sh |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify and generate the checksum value for the pinned uv installer.
set -euo pipefail
UV_VERSION="0.9.7"
curl -fsSL "https://astral.sh/uv/${UV_VERSION}/install.sh" -o uv_install.sh
sha256sum uv_install.shRepository: ByronWilliamsCPA/.github
Length of output: 209
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n=== Relevant slice ===\n'
sed -n '190,240p' .github/workflows/supply-chain-build-verify.yml
printf '\n=== Search occurrences ===\n'
rg -n "UV_VERSION|UV_INSTALLER_SHA256|require_uv_lock|astral.sh/uv|setup-uv" .github/workflows . -g '!**/node_modules/**' || trueRepository: ByronWilliamsCPA/.github
Length of output: 11022
Populate UV_INSTALLER_SHA256 before exposing require_uv_lock. Any caller that sets require_uv_lock: true will hit the empty-value exit here, so the gate can’t run until a real checksum is committed.
🧰 Tools
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 223-224: Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/supply-chain-build-verify.yml around lines 211 - 226,
Populate UV_INSTALLER_SHA256 in the supply-chain-build-verify workflow before
any caller can use require_uv_lock, because the current empty value causes the
UV installer checksum guard in the run block to exit immediately. Update the
UV_INSTALLER_SHA256 environment value with the real sha256 for the current
UV_VERSION, and make sure it is regenerated whenever UV_VERSION changes so the
workflow can proceed past the checksum check.
| echo "local_tar=${OUT_TAR}" >> "${GITHUB_OUTPUT}" | ||
| echo "artifact_name=build-${IMAGE_ID}-tar" >> "${GITHUB_OUTPUT}" | ||
| echo "built=true" >> "${GITHUB_OUTPUT}" | ||
| echo "Built ${IMAGE_ID}:build -> ${OUT_TAR}" | ||
|
|
||
| - name: Upload built image tar (passes to promote-core) | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: build-${{ inputs.image_id }}-tar | ||
| path: image.tar | ||
| retention-days: 1 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '250,330p' .github/workflows/supply-chain-build-verify.ymlRepository: ByronWilliamsCPA/.github
Length of output: 2151
🏁 Script executed:
rg -n "image_id|artifact_name|upload-artifact|build-" .github/workflows/supply-chain-build-verify.ymlRepository: ByronWilliamsCPA/.github
Length of output: 1042
🏁 Script executed:
python3 - <<'PY'
import re, pathlib
p = pathlib.Path('.github/workflows/supply-chain-build-verify.yml')
text = p.read_text()
# extract relevant job/step region and any image_id inputs near workflow_dispatch/reusable inputs
for pat in ['image_id', 'artifact_name', 'upload-artifact']:
print(f'== {pat} ==')
for m in re.finditer(pat, text):
start = max(0, m.start()-120)
end = min(len(text), m.end()+180)
print(text[start:end].replace('\n','\n'))
print('---')
PYRepository: ByronWilliamsCPA/.github
Length of output: 3569
🏁 Script executed:
git ls-files .github/workflows/supply-chain-build-verify.yml .github/workflows | sed -n '1,120p'Repository: ByronWilliamsCPA/.github
Length of output: 2061
🌐 Web query:
GitHub Actions upload-artifact artifact name invalid characters slash colon documentation
💡 Result:
In GitHub Actions, the artifact name parameter in the upload-artifact action has specific character restrictions to ensure it remains platform-agnostic, as artifacts must be compatible across various operating systems including Linux, macOS, and Windows (NTFS) [1][2][3]. If your artifact name contains invalid characters, the upload will be rejected by the server, and the action will fail [1][4]. The following characters are strictly prohibited in the name parameter [1][4]: - Forward slash (/) [1][5] - Backslash () [1] - Double quote (") [1] - Colon (:) [1][3] - Less than (<) [1] - Greater than (>) [1] - Pipe (|) [1] - Asterisk (*) [1] - Question mark (?) [1] These restrictions are deliberate and by design to prevent issues with file systems that do not support these characters [2][3]. GitHub does not plan to implement automatic sanitization or escaping for these names; therefore, if you need to include dynamic data (such as matrix variables or timestamps) in your artifact name, you must sanitize or replace these characters yourself within your workflow before passing the value to the name parameter [2][3]. A common practice is to replace invalid characters with a hyphen (-) using shell commands like sed [2].
Citations:
- 1: https://github.com/actions/toolkit/blob/master/packages/artifact/docs/additional-information.md
- 2: Name Restrictions actions/upload-artifact#22
- 3: ##[error]Artifact path is not valid: /debug-V1.9-DEBUG-28May-08:53AM.apk. Contains character: ":". Invalid characters include: ",:,<,>,|,*,?. actions/upload-artifact#85
- 4: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md
- 5: [bug] name field doesn't support all-blob-reports-${{ matrix.shard }} actions/upload-artifact#692
🌐 Web query:
site:github.com actions/upload-artifact artifact name slash colon allowed
💡 Result:
No, neither slash (/) nor colon (:) are allowed in artifact names for the GitHub Actions actions/upload-artifact action [1][2]. These restrictions are by design to ensure that artifacts remain platform-agnostic [3][4]. Because artifacts are often uploaded on one operating system and downloaded on another, the action strictly forbids characters that are invalid or problematic on common filesystems (such as NTFS) or specific platforms (such as macOS) [1][2][3][4]. The full list of disallowed characters in the name parameter includes [1][2][5]: - Forward slash (/) - Backslash () - Colon (:) - Double quote (") - Less than (<) - Greater than (>) - Vertical bar (|) - Asterisk (*) - Question mark (?) - Carriage return (\r) - Line feed (\n) If you need to use values that contain these characters (such as Git branch names or timestamps) as part of your artifact name, you must sanitize or encode them first [3][6]. Common workarounds include using tools like sed to replace invalid characters with a hyphen (-) or another allowed character [3].
Citations:
- 1: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md
- 2: https://github.com/actions/toolkit/blob/master/packages/artifact/docs/additional-information.md
- 3: Name Restrictions actions/upload-artifact#22
- 4: ##[error]Artifact path is not valid: /debug-V1.9-DEBUG-28May-08:53AM.apk. Contains character: ":". Invalid characters include: ",:,<,>,|,*,?. actions/upload-artifact#85
- 5: [feat req] Allow slashes in artifact name actions/upload-artifact#647
- 6: plan: sanitize
/inartifact_name—actions/upload-artifact@v4rejects slashes thekevinscott/putitoutthere#230
🏁 Script executed:
rg -n "image_id" .github/workflows . -g '!**/node_modules/**'Repository: ByronWilliamsCPA/.github
Length of output: 1579
🏁 Script executed:
sed -n '1,220p' .github/workflows/supply-chain-build-verify.ymlRepository: ByronWilliamsCPA/.github
Length of output: 9088
Slug image_id before using it as an artifact name. inputs.image_id is passed through directly here, but actions/upload-artifact rejects names containing characters like / or :, so container-style image IDs can break the build output and downstream handoff. Derive one sanitized artifact name in the build step and reuse that output for upload.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/supply-chain-build-verify.yml around lines 292 - 302, The
artifact naming in the build upload step uses inputs.image_id directly, which
can include invalid characters for actions/upload-artifact. Update the build
step that sets GITHUB_OUTPUT to derive a single sanitized slug from IMAGE_ID
(for example in the step that already emits artifact_name), then reuse that
output in the Upload built image tar step instead of build-${{ inputs.image_id
}}-tar so the artifact name is always valid.
| # #CRITICAL: anchored and dot-escaped; a bare dot matches any character. | ||
| # #VERIFY update this default when wiring non-GitHub-Actions upstream signers. | ||
| default: '^https://token\.actions\.githubusercontent\.com$' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/supply-chain-mirror-verify.yml"
echo "== Outline =="
ast-grep outline "$file" --view expanded || true
echo
echo "== Relevant lines =="
nl -ba "$file" | sed -n '60,220p'
echo
echo "== Search for issuer/identity guards =="
rg -n "expected_(identity|issuer)_regexp|IDENTITY|ISSUER|require_upstream_signature|cosign verify" "$file"Repository: ByronWilliamsCPA/.github
Length of output: 302
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/supply-chain-mirror-verify.yml"
echo "== File size =="
wc -l "$file"
echo
echo "== Lines 60-220 =="
sed -n '60,220p' "$file"
echo
echo "== Issuer/identity-related matches =="
grep -nE 'expected_(identity|issuer)_regexp|IDENTITY|ISSUER|require_upstream_signature|cosign verify' "$file"Repository: ByronWilliamsCPA/.github
Length of output: 7771
Reject empty or wildcard issuer overrides when signatures are required.
expected_issuer_regexp is still caller-controlled, so cosign verify can be weakened to accept any issuer. Add the same fail-closed guard used for IDENTITY before verification.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/supply-chain-mirror-verify.yml around lines 68 - 70, The
verification flow still allows a caller-controlled expected_issuer_regexp, which
can weaken cosign verification when signatures are required. In the workflow
logic that uses the issuer override, add the same fail-closed validation used
for IDENTITY so empty or wildcard issuer values are rejected before verification
proceeds. Update the relevant verification step around the issuer handling to
ensure only a strict, anchored issuer is accepted when signatures are enforced.
| # #CRITICAL: Trivy was removed in PR #229 (64ad9cf) because Trivy's release | ||
| # infrastructure was compromised in March 2026. This re-introduction must be | ||
| # accompanied by a documented re-vetting decision and ADR-012 before merge. | ||
| # #VERIFY: either replace with Grype (consistent with PR #229) or document | ||
| # that Trivy's supply chain has been audited and cleared since the compromise. | ||
| - name: Trivy gate (blocks on configured severities, pre-publish) | ||
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether the repo now contains the required ADR/re-vetting record.
set -euo pipefail
rg -n 'ADR-012|Trivy|trivy|Grype|grype|64ad9cf|PR `#229`' .Repository: ByronWilliamsCPA/.github
Length of output: 7496
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the workflow and relevant references before reading slices.
printf '\n== workflow outline ==\n'
ast-grep outline .github/workflows/supply-chain-promote-core.yml --view expanded || true
printf '\n== workflow slice around the Trivy gate ==\n'
sed -n '150,210p' .github/workflows/supply-chain-promote-core.yml | cat -n
printf '\n== search for ADR-012 / re-vetting / Trivy cutover references ==\n'
rg -n 'ADR-012|re-vetting|revet|re-approval|Trivy was removed|compromised in March 2026|cutover|Grype is now the gating runtime-dependency CVE scanner' CHANGELOG.md docs .github/workflows workflow-templates README.md SECURITY.md || trueRepository: ByronWilliamsCPA/.github
Length of output: 6208
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== workflow slice around the Trivy gate ==\n'
sed -n '150,210p' .github/workflows/supply-chain-promote-core.yml | cat -n
printf '\n== search for ADR-012 / re-vetting / Trivy cutover references ==\n'
rg -n 'ADR-012|re-vetting|revet|re-approval|Trivy was removed|compromised in March 2026|cutover|Grype is now the gating runtime-dependency CVE scanner' CHANGELOG.md docs .github/workflows workflow-templates README.md SECURITY.md || trueRepository: ByronWilliamsCPA/.github
Length of output: 6122
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/supply-chain-promote-core.yml')
text = p.read_text()
for start in [170]:
lines = text.splitlines()
for i in range(start-10, min(start+20, len(lines))):
print(f"{i+1}: {lines[i]}")
PYRepository: ByronWilliamsCPA/.github
Length of output: 1978
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '170,200p' .github/workflows/supply-chain-promote-core.yml | cat -nRepository: ByronWilliamsCPA/.github
Length of output: 1846
Keep the Trivy gate blocked until ADR-012 is recorded. This workflow reintroduces Trivy as a pre-publish blocker, but the repo history documents the Trivy-to-Grype cutover after the March 2026 compromise. Swap to the vetted scanner here or land the re-approval first.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/supply-chain-promote-core.yml around lines 181 - 187, The
Trivy gate in the workflow reintroduces a pre-publish blocker before ADR-012
approval is documented. Update the Trivy gate step to use the vetted scanner
path already established by the PR `#229` cutover (or otherwise keep it disabled)
until re-approval is recorded, and ensure the job definition around the Trivy
gate is aligned with the approved supply-chain scanning policy.
| # #CRITICAL: guard against path traversal in LOCK_FILE (caller-controlled). | ||
| # Allows only repo-relative YAML paths; rejects leading slash, .., spaces. | ||
| # #VERIFY update the pattern if new lock-file naming conventions are added. | ||
| if ! printf '%s' "${LOCK_FILE}" | grep -Eq '^[a-zA-Z0-9][a-zA-Z0-9._/-]*\.ya?ml$'; then | ||
| echo "::error::lock_file has unexpected path shape: ${LOCK_FILE}" | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Actually reject .. path segments in LOCK_FILE.
The comment says traversal is rejected, but the regex allows values like locks/../.github/workflows/publish.yml. Since this job has contents: write, reject .. explicitly before passing the path to the updater and git add.
Suggested fix
+ case "${LOCK_FILE}" in
+ /*|*..*|*[$'\n\r\t ']*)
+ echo "::error::lock_file must be a repo-relative YAML path without traversal or whitespace: ${LOCK_FILE}"
+ exit 1
+ ;;
+ esac
if ! printf '%s' "${LOCK_FILE}" | grep -Eq '^[a-zA-Z0-9][a-zA-Z0-9._/-]*\.ya?ml$'; then
echo "::error::lock_file has unexpected path shape: ${LOCK_FILE}"
exit 1
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # #CRITICAL: guard against path traversal in LOCK_FILE (caller-controlled). | |
| # Allows only repo-relative YAML paths; rejects leading slash, .., spaces. | |
| # #VERIFY update the pattern if new lock-file naming conventions are added. | |
| if ! printf '%s' "${LOCK_FILE}" | grep -Eq '^[a-zA-Z0-9][a-zA-Z0-9._/-]*\.ya?ml$'; then | |
| echo "::error::lock_file has unexpected path shape: ${LOCK_FILE}" | |
| exit 1 | |
| fi | |
| # `#CRITICAL`: guard against path traversal in LOCK_FILE (caller-controlled). | |
| # Allows only repo-relative YAML paths; rejects leading slash, .., spaces. | |
| # `#VERIFY` update the pattern if new lock-file naming conventions are added. | |
| case "${LOCK_FILE}" in | |
| /*|*..*|*[$'\n\r\t ']*) | |
| echo "::error::lock_file must be a repo-relative YAML path without traversal or whitespace: ${LOCK_FILE}" | |
| exit 1 | |
| ;; | |
| esac | |
| if ! printf '%s' "${LOCK_FILE}" | grep -Eq '^[a-zA-Z0-9][a-zA-Z0-9._/-]*\.ya?ml$'; then | |
| echo "::error::lock_file has unexpected path shape: ${LOCK_FILE}" | |
| exit 1 | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/supply-chain-promote-core.yml around lines 388 - 394, The
LOCK_FILE validation in the workflow still allows path traversal because the
current regex admits embedded .. segments such as
locks/../.github/workflows/publish.yml. Update the LOCK_FILE guard in the
validation block to explicitly reject any value containing .. before it is
passed to the updater or git add, while keeping the existing repo-relative YAML
path checks in place.
… scripts Add --proto '=https' to all curl --location invocations in supply-chain-build-verify.yml, supply-chain-mirror-verify.yml, and supply-chain-promote-core.yml to prevent protocol-downgrade attacks on redirects during tool downloads (SonarCloud S6506, 4 instances). Add --ignore-scripts to npm install -g snyk in supply-chain-promote-core.yml to prevent arbitrary lifecycle hook execution during package installation (SonarCloud S6505, 1 instance). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
SonarCloud S6505 / S6506 fixes (commit 2ea6a22)Five remaining MAJOR vulnerabilities resolved:
Note on S6505: The qlty gate failure shown in the PR checks predates these commits; a new qlty run against the current HEAD should clear it. |
…directs (SC2129)
Group consecutive echo >> file writes into { ...; } >> file blocks in
supply-chain-build-verify.yml (GITHUB_OUTPUT, 3 writes) and
supply-chain-consume-verify.yml (GITHUB_STEP_SUMMARY, 5 writes) to satisfy
shellcheck SC2129 and clear the qlty gate.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
1 participant
Summary
The shared trust core for the container supply-chain overhaul (P2 of homelab-infra plan v2.1 / ADR-012). Four
workflow_callreusable workflows that bothcontainer-images(public) andhomelab-infra(private) will call, so rigor is consistent across both repos and both upstream paths by construction.These are INERT until P3 wires callers, nothing invokes them yet, so this PR cannot change any pipeline behavior on merge.
The four workflows
supply-chain-mirror-verify.*identity), RT-11 (digest shape-guard)supply-chain-build-verifysupply-chain-promote-core[skip ci])supply-chain-consume-verifyenforceinput; fail-closed on impossible verificationDesign notes for review
scan(noid-token, nopackages:write) materializes the candidate to a local tar and runs Trivy+Snyk;publishruns only on pass. A scanner-stage compromise therefore cannot mint trust or leak the publish token.#VERIFYmarkers flag values to confirm when wiring callers: the real DHI/distroless Fulcio identities + issuers, snykdocker-archive:support in the pinned CLI, and the uv install method.Verification
yaml.safe_loadparses, no em-dashes, all actions SHA-pinned, every input passed viaenv:.Two of the four (build-verify, consume-verify) were drafted by subagents to a tight spec and reviewed; the security-critical pair (mirror-verify, promote-core) was authored directly.
Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
verifiedoutput behavior.