feat: add provenance for SLSA3 #1393
Conversation
WalkthroughThe pull request modifies the GitHub Actions workflow file Changes
Sequence DiagramsequenceDiagram
participant Workflow as GitHub Actions Workflow
participant Docker as Docker Build Action
Workflow->>Docker: Trigger build with provenance=mode=max
Docker-->>Workflow: Build and publish image with enhanced metadata
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (3)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
COLDTURNIP
changed the title
COLDTURNIP
force-pushed
the
feat-slsa3_support
branch
from
28a533f to
504c8a2
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
119-119: Consider documenting SLSA3 compliance.Since this change is specifically for SLSA3 compliance, consider adding a comment in the workflow file or updating the repository documentation to indicate the SLSA3 provenance support.
Add a comment before each publish step or at the workflow level:
name: build +# This workflow generates SLSA3 provenance for all published Docker images on: push:Also applies to: 143-143, 212-212, 236-236
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(4 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: Build AMD64 binaries
- GitHub Check: Build ARM64 binaries
- GitHub Check: Summary
🔇 Additional comments (1)
.github/workflows/build.yml (1)
119-119: LGTM! Consistent implementation of SLSA3 provenance.The addition of
provenance: mode=maxto all Docker image publishing steps is correct and consistent with SLSA3 requirements. The changes appropriately complement the existing SBOM generation.Let's verify that all Docker publish steps have provenance enabled:
Also applies to: 143-143, 212-212, 236-236
✅ Verification successful
✅ Verified: SLSA3 provenance correctly configured for all Docker publish steps
All four Docker image publishing steps have the required
provenance: mode=maxconfiguration:
- AMD64 head and tag builds
- ARM64 head and tag builds
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that all docker/build-push-action@v5 publish steps have provenance enabled # Expected: All push: true steps should have provenance: mode=max rg -A 10 'push: true' .github/workflows/build.yml | rg -B 10 'docker/build-push-action@v5'Length of output: 869
Script:
#!/bin/bash # Description: Find all docker/build-push-action@v5 steps and their configurations # Using a wider context to ensure we catch all instances rg -B 5 -A 15 'docker/build-push-action@v5' .github/workflows/build.ymlLength of output: 3673
Signed-off-by: Raphanus Lo <[email protected]>
COLDTURNIP
force-pushed
the
feat-slsa3_support
branch
from
504c8a2 to
da8a899
Compare
|
In favor of #1403 |
Which issue(s) this PR fixes:
To support SASA3