[patch] Harden verified image publication (#17)

Author: pennypacker-he

.github/workflows/actionlint.yaml

@@ -5,12 +5,14 @@ on:
     paths:
       - ".github/actions/**"
       - ".github/workflows/**"
+      - "scripts/test-image-workflow.sh"
   push:
     branches:
       - main
     paths:
       - ".github/actions/**"
       - ".github/workflows/**"
+      - "scripts/test-image-workflow.sh"
 
 permissions:
   contents: read
@@ -33,3 +35,6 @@ jobs:
 
       - name: Validate workflows
         run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+
+      - name: Validate image publication contract
+        run: bash scripts/test-image-workflow.sh

.github/workflows/build-push.yaml

@@ -2,17 +2,73 @@ name: build-push
 
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - Dockerfile
+      - .github/workflows/build-push.yaml
+      - scripts/test-image-workflow.sh
   push:
     branches:
       - main
     paths:
       - Dockerfile
       - .github/workflows/build-push.yaml
+      - scripts/test-image-workflow.sh
+
+permissions:
+  contents: read
 
 jobs:
+  image-check:
+    if: github.event_name == 'pull_request'
+    strategy:
+      fail-fast: false
+      matrix:
+        architecture:
+          - runner: ubuntu-24.04
+            platform: linux/amd64
+            suffix: amd64
+          - runner: ubuntu-24.04-arm
+            platform: linux/arm64
+            suffix: arm64
+    runs-on: ${{ matrix.architecture.runner }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+
+      - name: Build native image without credentials
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        with:
+          context: .
+          load: true
+          platforms: ${{ matrix.architecture.platform }}
+          provenance: false
+          push: false
+          tags: terraform-linux-packages:ci-${{ matrix.architecture.suffix }}
+
+      - name: Scan native image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: terraform-linux-packages:ci-${{ matrix.architecture.suffix }}
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          severity: HIGH,CRITICAL
+          vuln-type: os,library
+
   run:
-    uses: libops/.github/.github/workflows/build-push.yaml@d7f0ba06b4c8a1f8559892ea65a0b1af4d024dd3 # main
+    if: github.ref == 'refs/heads/main'
+    uses: libops/.github/.github/workflows/build-push.yaml@a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7 # guarded-signed-image-publisher
+    with:
+      ref: ${{ github.sha }}
+      expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
+      scan: true
+      sign: true
+      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7
     permissions:
       contents: read
       packages: write
-    secrets: inherit
+      id-token: write

Dockerfile

@@ -1,5 +1,15 @@
-FROM gcr.io/google.com/cloudsdktool/google-cloud-cli:slim@sha256:61cdaee8f89a2500c8e93fac2499d98a5b7692fcc3d7d69abbef48200477cb71
+FROM gcr.io/google.com/cloudsdktool/google-cloud-cli:slim@sha256:288bee65409ada9168944d1af8050247b556f8c0aeef97a3889ea05ee6294d7c
+
+ENV CLOUDSDK_STORAGE_USE_GCLOUD_CRC32C=false
 
 RUN apt-get update \
+  && apt-get upgrade -y \
   && apt-get install -y --no-install-recommends aptly createrepo-c gnupg ca-certificates dpkg-dev rpm \
+  && if [ -x /usr/lib/google-cloud-sdk/platform/bundledpythonunix/bin/python3 ]; then \
+    /usr/lib/google-cloud-sdk/platform/bundledpythonunix/bin/python3 -m pip install \
+      --no-cache-dir \
+      --only-binary=:all: \
+      cryptography==48.0.1; \
+    fi \
+  && rm -f /usr/lib/google-cloud-sdk/bin/gcloud-crc32c \
   && rm -rf /var/lib/apt/lists/*

scripts/test-image-workflow.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+DOCKERFILE="${ROOT_DIR}/Dockerfile"
+WORKFLOW="${ROOT_DIR}/.github/workflows/build-push.yaml"
+SHARED_PUBLISHER_SHA="a86300fb8020d0f7141bb9f833d89b5dbd7aa4d7"
+
+require_text() {
+  local value="$1"
+  if ! grep -Fq -- "$value" "$WORKFLOW"; then
+    printf 'image workflow must contain: %s\n' "$value" >&2
+    return 1
+  fi
+}
+
+forbid_text() {
+  local value="$1"
+  if grep -Fq -- "$value" "$WORKFLOW"; then
+    printf 'image workflow must not contain: %s\n' "$value" >&2
+    return 1
+  fi
+}
+
+require_text "pull_request:"
+require_text "if: github.event_name == 'pull_request'"
+require_text "if: github.ref == 'refs/heads/main'"
+require_text "Build native image without credentials"
+require_text "libops/.github/.github/workflows/build-push.yaml@${SHARED_PUBLISHER_SHA}"
+require_text 'ref: ${{ github.sha }}'
+require_text "expected-main-sha: \${{ github.ref == 'refs/heads/main' && github.sha || '' }}"
+require_text "scan: true"
+require_text "sign: true"
+require_text "certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@${SHARED_PUBLISHER_SHA}"
+require_text "packages: write"
+require_text "id-token: write"
+
+forbid_text "build-push.yaml@main"
+forbid_text "build-push-ghcr.yaml"
+forbid_text "secrets: inherit"
+forbid_text "docker-registry:"
+forbid_text "additional-gar-registry:"
+
+grep -Fq 'CLOUDSDK_STORAGE_USE_GCLOUD_CRC32C=false' "$DOCKERFILE"
+grep -Fq 'cryptography==48.0.1' "$DOCKERFILE"
+grep -Fq 'rm -f /usr/lib/google-cloud-sdk/bin/gcloud-crc32c' "$DOCKERFILE"