Add cosigning and provenance attestation to image builds#2073
Conversation
Signed-off-by: averevki <sandyverevkin@gmail.com>
📝 WalkthroughWalkthroughCosign image signing and provenance attestation are added to operator, bundle, and catalog image builds. The base reusable workflow enables Docker provenance and appends cosign signing steps. The tag-release workflow gains full cosign sign and ChangesImage Signing and Provenance
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2073 +/- ##
==========================================
- Coverage 75.08% 74.99% -0.10%
==========================================
Files 127 127
Lines 12632 12632
==========================================
- Hits 9485 9473 -12
- Misses 2665 2670 +5
- Partials 482 489 +7
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/build-images-base.yaml (1)
161-165: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDeclare least-privilege permissions inside the reusable workflow jobs.
The callers now pass
contents: readandid-token: write, but these signing jobs still omit their ownpermissionsblocks. Add the same minimal scopes to each job that checks out code and signs images so future callers cannot accidentally run this reusable workflow with broader default token permissions.🔒 Proposed hardening
build: name: Build runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps:build-bundle: needs: build name: Build Bundle runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps:build-catalog: name: Build Catalog needs: [build, build-bundle] runs-on: ubuntu-latest + permissions: + contents: read + id-token: write steps:Also applies to: 224-228, 280-284
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-images-base.yaml around lines 161 - 165, Add explicit least-privilege permissions to each reusable workflow job that performs checkout and image signing, instead of relying on caller defaults. Update the jobs containing the “Install cosign” and “Sign image with cosign” steps to declare the same minimal scopes, using the job-level permissions block so future callers cannot inherit broader token access. Apply the same hardening to the other matching signing jobs referenced by the workflow.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/build-images-base.yaml:
- Around line 161-165: Add explicit least-privilege permissions to each reusable
workflow job that performs checkout and image signing, instead of relying on
caller defaults. Update the jobs containing the “Install cosign” and “Sign image
with cosign” steps to declare the same minimal scopes, using the job-level
permissions block so future callers cannot inherit broader token access. Apply
the same hardening to the other matching signing jobs referenced by the
workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 28438a18-b051-4c20-874f-ef15b7ad7e62
📒 Files selected for processing (5)
.github/workflows/build-images-base.yaml.github/workflows/build-images-branches.yaml.github/workflows/build-images-for-tag-release.yaml.github/workflows/build-images-main.yaml.github/workflows/build-images-nightly.yaml
2 participants
Summary
signing using the GitHub OIDC identity
provenance: true) and addactions/attest@v4provenance attestation for buildah-based tag release workflowPart of the work on #2038
Context
This improves the Signed-Releases (https://github.com/ossf/scorecard/blob/main/docs/checks.md#signed-releases) check from the OpenSSF Scorecard (https://scorecard.dev/). Merging this should bring this section score from current 0 to 10.
Verification
Building workflows with the new changes were executed on my fork of the kuadrant-operator, and the successful run can be found here, with the images pushed here
Summary by CodeRabbit