ISX-86: Build public images #24
Conversation
* use dev branch * push * test * test * fix perms * are perms needed? * yes they are * add perms to remaning workflows * test * test * test * test * Update .github/workflows/build-image-from-tag-push.yml * Also bump the version in the rebuild workflow. --------- Co-authored-by: Alexander Cairns <[email protected]>
WalkthroughWorkflow configuration files were updated to grant Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant Reusable Workflow (v2)
participant GitHub Packages
GitHub Actions->>Reusable Workflow (v2): Trigger build job
Reusable Workflow (v2)->>GitHub Packages: Publish/modify package (with write permission)
Poem
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/auto-semver.yml(1 hunks).github/workflows/build-image-from-tag-push.yml(2 hunks).github/workflows/rebuild-image.yml(2 hunks)CHANGELOG.md(0 hunks)VERSION(0 hunks)
💤 Files with no reviewable changes (2)
- CHANGELOG.md
- VERSION
| build: | ||
| if: github.event_name == 'push' || github.event_name == 'pull_request' | ||
| uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v1 | ||
| uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin reusable workflow to a commit SHA for supply-chain safety
Tag v2 can be force-moved. Pinning to the immutable commit SHA mitigates the risk of a compromised upstream tag.
- uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
+ # Pinned to the current HEAD of v2 (replace with actual hash)
+ uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@a1b2c3d4e5f6g7h8i9j0🤖 Prompt for AI Agents
In .github/workflows/build-image-from-tag-push.yml at line 25, the reusable
workflow is currently pinned to the tag 'v2', which can be force-updated and
poses a supply-chain risk. Replace the tag 'v2' with the specific immutable
commit SHA of that version to ensure supply-chain safety by preventing
unexpected changes from upstream.
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| packages: write |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Scope the new packages: write permission to the job, not the entire workflow
Granting packages: write at workflow-level means every job—present and future—runs with publish rights. Unless another job needs to push images, move this permission block under the build job to follow the principle of least privilege.
permissions:
id-token: write
contents: read
- packages: write
+ # keep workflow-level perms minimal; `packages: write` lives at job-levelThen inside jobs.build:
jobs:
build:
+ permissions:
+ packages: write
+ # inherits id-token/contents from workflow scope🤖 Prompt for AI Agents
In .github/workflows/build-image-from-tag-push.yml at line 7, the `packages:
write` permission is currently set at the workflow level, granting all jobs
publish rights. To follow the principle of least privilege, move the `packages:
write` permission block from the workflow level into the specific `build` job's
permissions section so only that job has write access to packages.
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| packages: write |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Same permission concern—consider job-scoped packages: write
As with the other workflows, limit packages: write to the job that actually pushes the image.
🤖 Prompt for AI Agents
In .github/workflows/auto-semver.yml at line 26, the permission `packages:
write` is currently set globally but should be limited to only the job that
pushes the image. Move the `packages: write` permission from the global or
workflow level to the specific job that performs the image push to restrict
permission scope and improve security.
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| packages: write |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Restrict permission scope
Move packages: write under jobs.build.permissions to avoid over-privileging unrelated jobs that may be added later.
🤖 Prompt for AI Agents
In .github/workflows/rebuild-image.yml at line 7, the permission `packages:
write` is currently set at the top level, which grants it globally. To restrict
the permission scope, move `packages: write` under the `jobs.build.permissions`
section so that only the build job has this permission, preventing unrelated
jobs from being over-privileged.
| jobs: | ||
| build: | ||
| uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v1 | ||
| uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Supply-chain hardening: pin the reusable workflow
For the same reasons noted in the tag-push workflow, replace @v2 with the commit SHA of the desired revision.
- uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
+ uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@a1b2c3d4e5f6g7h8i9j0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2 | |
| uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@a1b2c3d4e5f6g7h8i9j0 |
🤖 Prompt for AI Agents
In .github/workflows/rebuild-image.yml at line 24, the reusable workflow
reference uses a floating tag '@v2', which is not secure for supply-chain
hardening. Replace '@v2' with the specific commit SHA of the desired revision to
pin the reusable workflow to an exact version, ensuring consistent and secure
builds.
Alexander-Cairns
added
no-update
Summary by CodeRabbit