Merge pull request #11 from AstrumBot/ci-pin-runtime-versions-supply-chain

ci: pin runtime package versions and harden supply chain

Author: Nyrest

.github/workflows/docker-image.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
       - name: Prepare image metadata
         id: meta
@@ -60,39 +60,18 @@ jobs:
           } >> "${GITHUB_OUTPUT}"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build ${{ matrix.flavor }} image for verification
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          build-args: |
-            RUNTIME_FLAVOR=${{ matrix.flavor }}
-          load: true
-          tags: ${{ steps.meta.outputs.image }}:verify-${{ matrix.flavor }}
-          labels: |
-            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.description=AI agent runtime optimized for general tasks (${{ matrix.flavor }})
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.version=${{ steps.meta.outputs.version_tag }}
-          cache-from: type=gha,scope=push-${{ matrix.flavor }}
-          cache-to: type=gha,mode=max,scope=push-${{ matrix.flavor }}
-
-      - name: Verify ${{ matrix.flavor }} runtime
-        run: docker run --rm "${{ steps.meta.outputs.image }}:verify-${{ matrix.flavor }}" verify-runtime
-
-      - name: Push verified ${{ matrix.flavor }} image with attestations
+      - name: Build and push ${{ matrix.flavor }} candidate with attestations
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
         with:
           context: .
           file: ./Dockerfile
@@ -101,7 +80,7 @@ jobs:
           push: true
           provenance: mode=max
           sbom: true
-          tags: ${{ steps.meta.outputs.push_tags }}
+          tags: ${{ steps.meta.outputs.image }}:verify-${{ matrix.flavor }}
           labels: |
             org.opencontainers.image.title=${{ env.IMAGE_NAME }}
             org.opencontainers.image.description=AI agent runtime optimized for general tasks (${{ matrix.flavor }})
@@ -111,12 +90,35 @@ jobs:
           cache-from: type=gha,scope=push-${{ matrix.flavor }}
           cache-to: type=gha,mode=max,scope=push-${{ matrix.flavor }}
 
+      - name: Verify ${{ matrix.flavor }} runtime from pushed digest
+        run: |
+          docker pull "${{ steps.meta.outputs.image }}@${{ steps.push.outputs.digest }}"
+          docker tag "${{ steps.meta.outputs.image }}@${{ steps.push.outputs.digest }}" "${{ steps.meta.outputs.image }}:verify-${{ matrix.flavor }}"
+          docker run --rm "${{ steps.meta.outputs.image }}:verify-${{ matrix.flavor }}" verify-runtime
+
+      - name: Promote verified ${{ matrix.flavor }} digest to version tags
+        run: |
+          docker buildx imagetools create \
+            --tag "${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.version_tag }}" \
+            "${{ steps.meta.outputs.image }}@${{ steps.push.outputs.digest }}"
+
+      - name: Promote verified ${{ matrix.flavor }} digest to stable tags
+        run: |
+          tags="${{ steps.meta.outputs.push_tags }}"
+          args=""
+          while IFS= read -r tag; do
+            [ -n "$tag" ] || continue
+            args="$args --tag $tag"
+          done <<< "$tags"
+          # shellcheck disable=SC2086
+          docker buildx imagetools create $args "${{ steps.meta.outputs.image }}@${{ steps.push.outputs.digest }}"
+
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3.8.1
+        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a
         with:
-          cosign-release: 'v2.4.3'
+          cosign-release: v2.4.3
 
-      - name: Sign image with cosign
+      - name: Sign ${{ matrix.flavor }} image
         env:
           COSIGN_YES: true
         run: |