fix(container): publish scanned image from the build worker

kiyi commented

2026-09-19 16:20:15 -05:00

Member

ComfyUI run 91 built and passed scanning, then spent 37m52s transferring a 4.43 GB image artifact and failed all five finalization attempts. Publish the verified local archive from the same build job after the security gate instead of uploading/downloading image-payload between workers. Reuses the existing signing, evidence storage, archive validation and registry digest checks; image/evidence outputs and sanitized report artifacts remain.

Registry/signing credentials are scoped to the final publishing step. This deliberately replaces separate-job isolation with one trusted disposable worker, restricted to owner dispatch on the protected branch; step scoping is not process isolation. No PR image builds, scanner bypass, storage increase or worker placement change.

Validation: 9 container tests and 10 Forgejo workflow contract tests passed locally, including failure-before-push and output/credential wiring. Full hosted publication is pending a new immutable workflow release and paired uses/library_ref update in ComfyUI. No full build was dispatched. ClamAV performance is unchanged.

Related: Homelab/Comfy-UI#1

ComfyUI run 91 built and passed scanning, then spent 37m52s transferring a 4.43 GB image artifact and failed all five finalization attempts. Publish the verified local archive from the same build job after the security gate instead of uploading/downloading image-payload between workers. Reuses the existing signing, evidence storage, archive validation and registry digest checks; image/evidence outputs and sanitized report artifacts remain. Registry/signing credentials are scoped to the final publishing step. This deliberately replaces separate-job isolation with one trusted disposable worker, restricted to owner dispatch on the protected branch; step scoping is not process isolation. No PR image builds, scanner bypass, storage increase or worker placement change. Validation: 9 container tests and 10 Forgejo workflow contract tests passed locally, including failure-before-push and output/credential wiring. Full hosted publication is pending a new immutable workflow release and paired uses/library_ref update in ComfyUI. No full build was dispatched. ClamAV performance is unchanged. Related: https://git.gitchegumi.com/Homelab/Comfy-UI/issues/1

kiyi added 1 commit

2026-09-19 16:20:15 -05:00

fix(container): publish scanned image from the build worker

Workflow acceptance / acceptance (pull_request) Successful in 1m52s

Details

Library checks / tests (pull_request) Successful in 3m12s

Details

Repository security / security-1 (pull_request) Successful in 9m9s

Details

Repository security / security (pull_request) Successful in 0s

Details

3d893097c4