Skip to content

Commit 7a4abee

Browse files
mldangelo-oaimldangelo-oai
authored
ci: modernize and harden container workflows (#163)
1 parent 780c207 commit 7a4abee

2 files changed

Lines changed: 25 additions & 15 deletions

File tree

‎.github/workflows/container-ci.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,16 +78,20 @@ jobs:
7878
done
7979
8080
- name: Set up Docker Buildx
81-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
81+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
8282

8383
- name: Build customer container
84-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
84+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
85+
env:
86+
DOCKER_BUILD_RECORD_UPLOAD: "false"
8587
with:
8688
context: .
8789
load: true
8890
platforms: linux/amd64
8991
push: false
9092
tags: codex-security:ci
93+
cache-from: type=gha,scope=codex-security-amd64
94+
cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=codex-security-amd64' || '' }}
9195

9296
- name: Verify bundled scanner
9397
run: |
@@ -129,7 +133,7 @@ jobs:
129133
if output="$("${command[@]}" sandbox /usr/bin/true 2>&1)"; then
130134
printf '%s\n' "$output"
131135
elif grep -Eq 'bwrap: (Failed to make / slave: Permission denied|loopback: Failed RTM_NEW(ADDR|LINK): Operation not permitted|setting up uid map: Permission denied|No permissions to create a new namespace)' <<< "$output"; then
132-
echo '::warning::This Docker host blocks nested Bubblewrap namespaces; verifying the supported Landlock fallback.'
136+
echo '::notice::This Docker host blocks nested Bubblewrap namespaces; verifying the supported Landlock fallback.'
133137
"${command[@]}" sandbox --enable use_legacy_landlock /usr/bin/true
134138
else
135139
printf 'The hardened Codex sandbox failed unexpectedly:\n%s\n' "$output" >&2

‎.github/workflows/container-release.yml‎

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -45,16 +45,20 @@ jobs:
4545
persist-credentials: false
4646

4747
- name: Set up Docker Buildx
48-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
48+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
4949

5050
- name: Build native customer image
51-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
51+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
52+
env:
53+
DOCKER_BUILD_RECORD_UPLOAD: "false"
5254
with:
5355
context: .
5456
load: true
5557
platforms: linux/${{ matrix.architecture }}
5658
push: false
5759
tags: codex-security:release-candidate
60+
cache-from: type=gha,scope=codex-security-${{ matrix.architecture }}
61+
cache-to: ${{ github.event_name != 'pull_request' && format('type=gha,mode=max,scope=codex-security-{0}', matrix.architecture) || '' }}
5862

5963
- name: Verify native image and bundled scanner
6064
env:
@@ -124,7 +128,7 @@ jobs:
124128
if output="$("${command[@]}" sandbox /usr/bin/true 2>&1)"; then
125129
printf '%s\n' "$output"
126130
elif grep -Eq 'bwrap: (Failed to make / slave: Permission denied|loopback: Failed RTM_NEW(ADDR|LINK): Operation not permitted|setting up uid map: Permission denied|No permissions to create a new namespace)' <<< "$output"; then
127-
echo '::warning::This Docker host blocks nested Bubblewrap namespaces; verifying the supported Landlock fallback.'
131+
echo '::notice::This Docker host blocks nested Bubblewrap namespaces; verifying the supported Landlock fallback.'
128132
"${command[@]}" sandbox --enable use_legacy_landlock /usr/bin/true
129133
else
130134
printf 'The hardened Codex sandbox failed unexpectedly:\n%s\n' "$output" >&2
@@ -322,24 +326,26 @@ jobs:
322326
persist-credentials: false
323327

324328
- name: Set up Docker Buildx
325-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
329+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
326330

327331
- name: Sign in to GitHub Container Registry
328-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
332+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
329333
with:
330334
registry: ghcr.io
331335
username: ${{ github.actor }}
332336
password: ${{ secrets.GITHUB_TOKEN }}
333337

334338
- name: Publish native image by immutable digest
335339
id: build
336-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
340+
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
337341
with:
338342
context: .
339343
platforms: linux/${{ matrix.architecture }}
340344
outputs: type=image,name=${{ needs.authorize.outputs.image }},push-by-digest=true,name-canonical=true,push=true
341345
provenance: mode=max
342346
sbom: true
347+
cache-from: type=gha,scope=codex-security-${{ matrix.architecture }}
348+
cache-to: type=gha,mode=max,scope=codex-security-${{ matrix.architecture }}
343349
labels: |
344350
org.opencontainers.image.source=https://github.com/${{ github.repository }}
345351
org.opencontainers.image.version=${{ needs.authorize.outputs.version }}
@@ -416,7 +422,7 @@ jobs:
416422
persist-credentials: false
417423

418424
- name: Set up Docker Buildx
419-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
425+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
420426

421427
- name: Download verified platform digests
422428
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -426,7 +432,7 @@ jobs:
426432
merge-multiple: true
427433

428434
- name: Sign in to GitHub Container Registry
429-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
435+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
430436
with:
431437
registry: ghcr.io
432438
username: ${{ github.actor }}
@@ -531,14 +537,14 @@ jobs:
531537

532538
steps:
533539
- name: Sign in to GitHub Container Registry
534-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
540+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
535541
with:
536542
registry: ghcr.io
537543
username: ${{ github.actor }}
538544
password: ${{ secrets.GITHUB_TOKEN }}
539545

540546
- name: Sign verified multiarchitecture candidate provenance
541-
uses: actions/attest-build-provenance@96b4a1ef7235a096b17240c259729fdd70c83d45 # v2
547+
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
542548
with:
543549
push-to-registry: true
544550
subject-name: ${{ needs.authorize.outputs.image }}
@@ -563,10 +569,10 @@ jobs:
563569
persist-credentials: false
564570

565571
- name: Set up Docker Buildx
566-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
572+
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
567573

568574
- name: Sign in to GitHub Container Registry
569-
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
575+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
570576
with:
571577
registry: ghcr.io
572578
username: ${{ github.actor }}

0 commit comments

Comments
 (0)