Skip to content

Commit 0080938

Browse files
coopernetesclaude
coopernetes
and
claude
authored
fix: gate release tags behind container scan, add retag workflow (#186)
* fix: gate release tags behind container scan, bump grype to 0.111.1 On tag pushes, build to an ephemeral :vX.Y.Z-rc tag first, scan it, then retag to :vX.Y.Z / :X.Y / :X / :latest only when the scan passes. This ensures :latest always points to a clean image. Edge continues to track every main commit without scanning — it's a mutable dev target and scan failures there are acceptable. Also bumps GRYPE_VERSION from 0.111.0 (non-existent release) to 0.111.1, applies the same PATH fix and tee-to-stdout report approach from the CVE jobs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: gate release tags behind container scan, bump grype to 0.111.1 Release flow for tag pushes: - Build to ephemeral :vX.Y.Z-pending tag - Scan by digest (fails build on high CVEs with a fix) - On scan pass: retag to :vX.Y.Z / :X.Y / :X / :latest, delete -pending :edge continues to track every main commit without scanning — mutable dev target, scan failures acceptable there. :latest now always points to a scan-clean release image. Also adds retag.yml — workflow_dispatch to retag any digest to arbitrary tags without rebuilding, for emergency promotions and re-pointing :latest. Bumps GRYPE_VERSION 0.111.0 → 0.111.1. The root cause of the original scan-action failure was a bug in that pinned commit of anchore/scan-action which constructs the download URL as /releases/0.111.0 instead of /releases/tag/v0.111.0, causing a 404. The fix bypasses the install script entirely and downloads directly from the GitHub releases URL. Applies PATH fix and tee-to-stdout report from the CVE jobs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent c0d3da7 commit 0080938

2 files changed

Lines changed: 110 additions & 26 deletions

File tree

‎.github/workflows/docker-publish.yml‎

Lines changed: 61 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,9 @@ jobs:
4747
with:
4848
images: ghcr.io/${{ github.repository }}
4949
tags: |
50-
type=ref,event=branch
5150
type=ref,event=pr
52-
type=semver,pattern={{version}}
53-
type=semver,pattern={{major}}.{{minor}}
54-
type=semver,pattern={{major}}
55-
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
5651
type=raw,value=edge,enable={{is_default_branch}}
52+
type=raw,value=${{ github.ref_name }}-pending,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
5753
type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' }}
5854
5955
- name: Build and push
@@ -84,10 +80,9 @@ jobs:
8480
runs-on: ubuntu-latest
8581
permissions:
8682
contents: read
87-
security-events: write
88-
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
83+
if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'
8984
env:
90-
GRYPE_VERSION: "0.111.0"
85+
GRYPE_VERSION: "0.111.1"
9186
steps:
9287
- name: Checkout
9388
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
@@ -108,32 +103,72 @@ jobs:
108103
# in the GitHub Security tab (high CVSS score ≠ high actual risk for this workload).
109104
# The build still fails on high/critical with a fix available via fail-build: true above.
110105

111-
- name: Install grype
106+
- name: Add grype to PATH
112107
if: always()
113-
run: |
114-
curl -sSfL -o /tmp/grype.tar.gz \
115-
https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_linux_amd64.tar.gz
116-
curl -sSfL -o /tmp/grype_checksums.txt \
117-
https://github.com/anchore/grype/releases/download/v${GRYPE_VERSION}/grype_${GRYPE_VERSION}_checksums.txt
118-
grep "grype_${GRYPE_VERSION}_linux_amd64.tar.gz" /tmp/grype_checksums.txt | sha256sum --check --ignore-missing
119-
tar -xzf /tmp/grype.tar.gz -C /usr/local/bin grype
120-
121-
- name: Generate human-readable report
108+
run: echo "$(dirname $(find /opt/hostedtoolcache/grype -name grype -type f | head -1))" >> $GITHUB_PATH
109+
110+
- name: Generate scan report
122111
if: always()
123112
run: |
124113
grype ghcr.io/${{ github.repository }}@${{ needs.build-and-push.outputs.digest }} \
125114
--config .grype.yaml \
126-
--output table > grype-report.txt || true
127-
grype ghcr.io/${{ github.repository }}@${{ needs.build-and-push.outputs.digest }} \
128-
--config .grype.yaml \
129-
--output json > grype-report.json || true
115+
--only-fixed \
116+
--output table | tee grype-report.txt || true
130117
131-
- name: Upload scan reports
118+
- name: Upload scan report
132119
if: always()
133120
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # ratchet:actions/upload-artifact@v7
134121
with:
135122
name: grype-container-scan
136-
path: |
137-
grype-report.txt
138-
grype-report.json
123+
path: grype-report.txt
139124
retention-days: 30
125+
126+
publish-release:
127+
name: Publish Release Tags
128+
needs: [build-and-push, scan]
129+
runs-on: ubuntu-latest
130+
if: startsWith(github.ref, 'refs/tags/v')
131+
permissions:
132+
contents: read
133+
packages: write
134+
135+
steps:
136+
- name: Log in to GHCR
137+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # ratchet:docker/login-action@v4
138+
with:
139+
registry: ghcr.io
140+
username: ${{ github.actor }}
141+
password: ${{ secrets.GITHUB_TOKEN }}
142+
143+
- name: Set up Docker Buildx
144+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # ratchet:docker/setup-buildx-action@v4
145+
146+
# Retag the scanned ephemeral image to final release tags without rebuilding.
147+
# Only runs after scan passes — latest always points to a clean image.
148+
- name: Retag to release version and latest
149+
run: |
150+
VERSION=${GITHUB_REF_NAME}
151+
MAJOR=$(echo ${VERSION} | cut -d. -f1)
152+
MINOR=$(echo ${VERSION} | cut -d. -f1-2)
153+
SOURCE="ghcr.io/${{ github.repository }}@${{ needs.build-and-push.outputs.digest }}"
154+
docker buildx imagetools create \
155+
--tag "ghcr.io/${{ github.repository }}:${VERSION}" \
156+
--tag "ghcr.io/${{ github.repository }}:${MINOR}" \
157+
--tag "ghcr.io/${{ github.repository }}:${MAJOR}" \
158+
--tag "ghcr.io/${{ github.repository }}:latest" \
159+
${SOURCE}
160+
161+
- name: Delete ephemeral pending tag
162+
env:
163+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
164+
run: |
165+
PACKAGE_NAME=$(basename ${{ github.repository }})
166+
TAG="${GITHUB_REF_NAME}-pending"
167+
VERSION_ID=$(gh api "/user/packages/container/${PACKAGE_NAME}/versions" \
168+
--paginate --jq ".[] | select(.metadata.container.tags[] == \"${TAG}\") | .id")
169+
if [ -n "${VERSION_ID}" ]; then
170+
gh api --method DELETE "/user/packages/container/${PACKAGE_NAME}/versions/${VERSION_ID}"
171+
echo "Deleted ephemeral tag ${TAG}"
172+
else
173+
echo "No ephemeral tag ${TAG} found — nothing to clean up"
174+
fi

‎.github/workflows/retag.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Retag Image
2+
3+
# Manually retag an existing image digest to one or more target tags without
4+
# rebuilding. Use cases:
5+
# - Re-point :latest to a previous release after a bad release
6+
# - Emergency: promote a known-good digest to a specific tag
7+
8+
on:
9+
workflow_dispatch:
10+
inputs:
11+
source-digest:
12+
description: "Source image digest (e.g. sha256:abc123...)"
13+
required: true
14+
type: string
15+
target-tags:
16+
description: "Space-separated target tags (e.g. 'latest v1.0.0 1.0')"
17+
required: true
18+
type: string
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
retag:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
packages: write
29+
30+
steps:
31+
- name: Log in to GHCR
32+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # ratchet:docker/login-action@v4
33+
with:
34+
registry: ghcr.io
35+
username: ${{ github.actor }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Set up Docker Buildx
39+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # ratchet:docker/setup-buildx-action@v4
40+
41+
- name: Retag
42+
run: |
43+
SOURCE="ghcr.io/${{ github.repository }}@${{ inputs.source-digest }}"
44+
TAG_ARGS=""
45+
for tag in ${{ inputs.target-tags }}; do
46+
TAG_ARGS="$TAG_ARGS --tag ghcr.io/${{ github.repository }}:${tag}"
47+
done
48+
echo "Retagging ${SOURCE} -> ${{ inputs.target-tags }}"
49+
docker buildx imagetools create ${TAG_ARGS} ${SOURCE}

0 commit comments

Comments
 (0)