Skip to content

Commit 904c7f1

Browse files
mldangelo-oaimldangelo-oai
committed
ci: bootstrap the public Codex Security container package
1 parent 8d9eb30 commit 904c7f1

1 file changed

Lines changed: 200 additions & 0 deletions

File tree

‎.github/workflows/container-registry-bootstrap.yml‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
name: bootstrap-container-package
2+
3+
on:
4+
push:
5+
branches:
6+
- mdangelo/codex/bootstrap-ghcr-8d9eb30
7+
paths:
8+
- .github/workflows/container-registry-bootstrap.yml
9+
10+
permissions:
11+
contents: read
12+
13+
concurrency:
14+
group: codex-security-container-registry-bootstrap
15+
queue: max
16+
17+
env:
18+
IMAGE: ghcr.io/openai/codex-security
19+
SOURCE_SHA: 8d9eb30dcf71853d9e55da517404d4aef6c74f64
20+
BOOTSTRAP_TAG: bootstrap-8d9eb30
21+
22+
jobs:
23+
publish-platform:
24+
if: >-
25+
github.repository == 'openai/codex-security' &&
26+
github.ref == 'refs/heads/mdangelo/codex/bootstrap-ghcr-8d9eb30'
27+
name: bootstrap-linux-${{ matrix.architecture }}
28+
runs-on: ${{ matrix.runner }}
29+
timeout-minutes: 45
30+
permissions:
31+
contents: read
32+
packages: write
33+
strategy:
34+
fail-fast: false
35+
max-parallel: 1
36+
matrix:
37+
include:
38+
- architecture: amd64
39+
runner: ubuntu-24.04
40+
- architecture: arm64
41+
runner: ubuntu-24.04-arm
42+
43+
steps:
44+
- name: Checkout the exact audited main commit
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
with:
47+
ref: 8d9eb30dcf71853d9e55da517404d4aef6c74f64
48+
persist-credentials: false
49+
50+
- name: Build and verify the native bootstrap image
51+
shell: bash
52+
env:
53+
ARCHITECTURE: ${{ matrix.architecture }}
54+
run: |
55+
set -euo pipefail
56+
if [[ "$(git rev-parse HEAD)" != "$SOURCE_SHA" ]]; then
57+
echo 'The bootstrap must build the exact audited main commit.' >&2
58+
exit 1
59+
fi
60+
61+
package_version="$(node -p 'require("./sdk/typescript/package.json").version')"
62+
if [[ "$package_version" != 0.1.3 ]]; then
63+
echo "Expected audited Codex Security 0.1.3; found $package_version." >&2
64+
exit 1
65+
fi
66+
67+
image="$IMAGE:$BOOTSTRAP_TAG-$ARCHITECTURE"
68+
docker build --progress=plain \
69+
--label "org.opencontainers.image.source=https://github.com/openai/codex-security" \
70+
--label "org.opencontainers.image.revision=$SOURCE_SHA" \
71+
--label "org.opencontainers.image.version=$package_version" \
72+
--tag "$image" \
73+
.
74+
75+
actual_architecture="$(docker image inspect --format '{{.Architecture}}' "$image")"
76+
if [[ "$actual_architecture" != "$ARCHITECTURE" ]]; then
77+
echo "Expected native $ARCHITECTURE; found $actual_architecture." >&2
78+
exit 1
79+
fi
80+
if [[ "$(docker run --rm "$image" --version)" != "$package_version" ]]; then
81+
echo 'The bootstrap image reports the wrong CLI version.' >&2
82+
exit 1
83+
fi
84+
if [[ "$(docker run --rm --entrypoint id "$image" -u)" != 10001 ]]; then
85+
echo 'The bootstrap image must preserve its nonroot runtime.' >&2
86+
exit 1
87+
fi
88+
docker run --rm "$image" bulk-scan --help > /dev/null
89+
docker run --rm "$image" info --json |
90+
jq --exit-status '.sdkVersion == "0.1.3" and .cliVersion == "0.1.3"' > /dev/null
91+
92+
- name: Publish only the architecture-specific bootstrap tag
93+
shell: bash
94+
env:
95+
ARCHITECTURE: ${{ matrix.architecture }}
96+
GH_TOKEN: ${{ github.token }}
97+
run: |
98+
set -euo pipefail
99+
printf '%s' "$GH_TOKEN" |
100+
docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
101+
docker push "$IMAGE:$BOOTSTRAP_TAG-$ARCHITECTURE"
102+
103+
verify-public-package:
104+
if: >-
105+
github.repository == 'openai/codex-security' &&
106+
github.ref == 'refs/heads/mdangelo/codex/bootstrap-ghcr-8d9eb30'
107+
name: verify public multi-architecture bootstrap
108+
needs: publish-platform
109+
runs-on: ubuntu-24.04
110+
timeout-minutes: 15
111+
permissions:
112+
contents: read
113+
packages: write
114+
outputs:
115+
manifest-digest: ${{ steps.manifest.outputs.digest }}
116+
117+
steps:
118+
- name: Log in only to assemble the bootstrap manifest
119+
shell: bash
120+
env:
121+
GH_TOKEN: ${{ github.token }}
122+
run: |
123+
set -euo pipefail
124+
printf '%s' "$GH_TOKEN" |
125+
docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
126+
127+
- name: Create and verify the native multi-architecture manifest
128+
id: manifest
129+
shell: bash
130+
run: |
131+
set -euo pipefail
132+
reference="$IMAGE:$BOOTSTRAP_TAG"
133+
docker buildx imagetools create \
134+
--tag "$reference" \
135+
"$IMAGE:$BOOTSTRAP_TAG-amd64" \
136+
"$IMAGE:$BOOTSTRAP_TAG-arm64"
137+
138+
manifest="$(docker buildx imagetools inspect "$reference" --format '{{json .Manifest}}')"
139+
if ! jq --exit-status '
140+
(.digest | type == "string" and startswith("sha256:")) and
141+
([.manifests[] | select(.platform.os == "linux") | .platform.architecture] | sort) ==
142+
["amd64", "arm64"]
143+
' <<< "$manifest" > /dev/null; then
144+
echo 'The bootstrap manifest must contain verified native amd64 and arm64 images.' >&2
145+
exit 1
146+
fi
147+
printf 'digest=%s\n' "$(jq --raw-output '.digest' <<< "$manifest")" >> "$GITHUB_OUTPUT"
148+
149+
- name: Verify public visibility and repository association
150+
shell: bash
151+
env:
152+
GH_TOKEN: ${{ github.token }}
153+
run: |
154+
set -euo pipefail
155+
metadata="$(gh api orgs/openai/packages/container/codex-security)"
156+
visibility="$(jq --exit-status --raw-output '.visibility' <<< "$metadata")"
157+
if [[ "$visibility" != public ]]; then
158+
echo "::error::GitHub created the package as $visibility. A package administrator must make it public before protected releases can proceed." >&2
159+
exit 1
160+
fi
161+
162+
repository="$(jq --raw-output '.repository.full_name // empty' <<< "$metadata")"
163+
if [[ -n "$repository" && "$repository" != openai/codex-security ]]; then
164+
echo "::error::The container package is linked to $repository instead of openai/codex-security." >&2
165+
exit 1
166+
fi
167+
168+
docker logout ghcr.io
169+
manifest="$(docker buildx imagetools inspect "$IMAGE:$BOOTSTRAP_TAG" --format '{{json .Manifest}}')"
170+
jq --exit-status '
171+
([.manifests[] | select(.platform.os == "linux") | .platform.architecture] | sort) ==
172+
["amd64", "arm64"]
173+
' <<< "$manifest" > /dev/null
174+
docker pull --platform linux/amd64 "$IMAGE:$BOOTSTRAP_TAG"
175+
if [[ "$(docker run --rm "$IMAGE:$BOOTSTRAP_TAG" --version)" != 0.1.3 ]]; then
176+
echo 'Anonymous GHCR pulls must expose the verified Codex Security CLI.' >&2
177+
exit 1
178+
fi
179+
180+
attest:
181+
if: >-
182+
github.repository == 'openai/codex-security' &&
183+
github.ref == 'refs/heads/mdangelo/codex/bootstrap-ghcr-8d9eb30'
184+
name: attest verified bootstrap manifest
185+
needs: verify-public-package
186+
runs-on: ubuntu-24.04
187+
timeout-minutes: 10
188+
permissions:
189+
attestations: write
190+
contents: read
191+
id-token: write
192+
packages: write
193+
194+
steps:
195+
- name: Attest the verified multi-architecture bootstrap digest
196+
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
197+
with:
198+
subject-name: ghcr.io/openai/codex-security
199+
subject-digest: ${{ needs.verify-public-package.outputs.manifest-digest }}
200+
push-to-registry: true

0 commit comments

Comments
 (0)