Skip to content

ISX-86: Build public images #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 11, 2025
Merged

ISX-86: Build public images #24

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b3d7cfa
ISX-86: Update workflows. (#8)
adam-vessey Jun 27, 2025
f5f456c
Merge commit 'b3d7cfa3d972db5d6ed19b8194e71646b9d6a2e8' into ISX-86
Alexander-Cairns Jun 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/auto-semver.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,5 +23,6 @@ jobs:
permissions:
id-token: write
contents: read
packages: write
Copy link

@coderabbitai coderabbitai bot Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Same permission concern—consider job-scoped packages: write

As with the other workflows, limit packages: write to the job that actually pushes the image.

🤖 Prompt for AI Agents 
In .github/workflows/auto-semver.yml at line 26, the permission `packages:
write` is currently set globally but should be limited to only the job that
pushes the image. Move the `packages: write` permission from the global or
workflow level to the specific job that performs the image push to restrict
permission scope and improve security.

with:
tag: ${{ needs.update.outputs.tag }}
3 changes: 2 additions & 1 deletion .github/workflows/build-image-from-tag-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ name: Build image from version tag
permissions:
id-token: write
contents: read
packages: write
Copy link

@coderabbitai coderabbitai bot Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Scope the new packages: write permission to the job, not the entire workflow

Granting packages: write at workflow-level means every job—present and future—runs with publish rights. Unless another job needs to push images, move this permission block under the build job to follow the principle of least privilege.

 permissions:
   id-token: write
   contents: read
-  packages: write
+  # keep workflow-level perms minimal; `packages: write` lives at job-level

Then inside jobs.build:

 jobs:
   build:
+    permissions:
+      packages: write
+      # inherits id-token/contents from workflow scope
🤖 Prompt for AI Agents 
In .github/workflows/build-image-from-tag-push.yml at line 7, the `packages:
write` permission is currently set at the workflow level, granting all jobs
publish rights. To follow the principle of least privilege, move the `packages:
write` permission block from the workflow level into the specific `build` job's
permissions section so only that job has write access to packages.

on:
push:
# XXX: Tags pushed via actions (i.e., auto-semver) are not able to trigger additional workflows;
Expand All @@ -21,7 +22,7 @@ on:
jobs:
build:
if: github.event_name == 'push' || github.event_name == 'pull_request'
uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v1
uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
Copy link

@coderabbitai coderabbitai bot Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Pin reusable workflow to a commit SHA for supply-chain safety

Tag v2 can be force-moved. Pinning to the immutable commit SHA mitigates the risk of a compromised upstream tag.

-    uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
+    # Pinned to the current HEAD of v2 (replace with actual hash)
+    uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@a1b2c3d4e5f6g7h8i9j0
🤖 Prompt for AI Agents 
In .github/workflows/build-image-from-tag-push.yml at line 25, the reusable
workflow is currently pinned to the tag 'v2', which can be force-updated and
poses a supply-chain risk. Replace the tag 'v2' with the specific immutable
commit SHA of that version to ensure supply-chain safety by preventing
unexpected changes from upstream.

secrets: inherit
with:
image-name: ${{ vars.DOCKER_IMAGE_NAME }}
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/rebuild-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ name: Rebuild image
permissions:
id-token: write
contents: read
packages: write
Copy link

@coderabbitai coderabbitai bot Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Restrict permission scope

Move packages: write under jobs.build.permissions to avoid over-privileging unrelated jobs that may be added later.

🤖 Prompt for AI Agents 
In .github/workflows/rebuild-image.yml at line 7, the permission `packages:
write` is currently set at the top level, which grants it globally. To restrict
the permission scope, move `packages: write` under the `jobs.build.permissions`
section so that only the build job has this permission, preventing unrelated
jobs from being over-privileged.

on:
schedule:
- cron: '47 4 1 * *'
Expand All @@ -20,7 +21,7 @@ on:

jobs:
build:
uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v1
uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
Copy link

@coderabbitai coderabbitai bot Jun 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Supply-chain hardening: pin the reusable workflow

For the same reasons noted in the tag-push workflow, replace @v2 with the commit SHA of the desired revision.

-    uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
+    uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@a1b2c3d4e5f6g7h8i9j0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@v2
uses: discoverygarden/docker-image-reusable-workflows/.github/workflows/build-image.yml@a1b2c3d4e5f6g7h8i9j0
🤖 Prompt for AI Agents 
In .github/workflows/rebuild-image.yml at line 24, the reusable workflow
reference uses a floating tag '@v2', which is not secure for supply-chain
hardening. Replace '@v2' with the specific commit SHA of the desired revision to
pin the reusable workflow to an exact version, ensuring consistent and secure
builds.

secrets: inherit
with:
env: ${{ inputs.env || github.event_name == 'pull_request' && 'dev' || 'prod' }}
Expand Down
14 changes: 0 additions & 14 deletions CHANGELOG.md
View file
Open in desktop

This file was deleted.

4 changes: 0 additions & 4 deletions VERSION
View file
Open in desktop

This file was deleted.

Loading