feat(delivery): scan and sign containers and UDS releases

kiyi commented

2026-09-03 22:44:46 -05:00

Member

Adds manual, reusable container publishing and UDS bundle build/deploy workflows. Owned images are built into a local archive, scanned with vulnerability, secret, configuration and ClamAV checks, and accompanied by signed scan reports and SBOM evidence uploaded before the registry push. Bundle deployment verifies signed file hashes, source provenance, current image scans, mitigation expiry and the selected cluster context.

Depends on #7; this PR is stacked on feat/security-pipelines. Merge #7 first, then retarget this PR to main. References #5. Runner migration (#2) remains deferred.

Validation: 23 unit tests and scaffold checks pass. Real scanner tests covered clean source, removed secrets in Git history, sanitized reports and downloaded Alpine image archives. Offline signing verified successfully and rejected tampering. No app images or UDS bundles were built, and no cluster deployment was performed.

Owner activation: follow docs/delivery.md to configure runner labels, protected-branch actor allowlists, registry credentials and signing/cluster secrets. Review and merge before running the UI workflows. End-to-end Forgejo publication/deployment remains an owner acceptance step.

Adds manual, reusable container publishing and UDS bundle build/deploy workflows. Owned images are built into a local archive, scanned with vulnerability, secret, configuration and ClamAV checks, and accompanied by signed scan reports and SBOM evidence uploaded before the registry push. Bundle deployment verifies signed file hashes, source provenance, current image scans, mitigation expiry and the selected cluster context. Depends on #7; this PR is stacked on feat/security-pipelines. Merge #7 first, then retarget this PR to main. References #5. Runner migration (#2) remains deferred. Validation: 23 unit tests and scaffold checks pass. Real scanner tests covered clean source, removed secrets in Git history, sanitized reports and downloaded Alpine image archives. Offline signing verified successfully and rejected tampering. No app images or UDS bundles were built, and no cluster deployment was performed. Owner activation: follow docs/delivery.md to configure runner labels, protected-branch actor allowlists, registry credentials and signing/cluster secrets. Review and merge before running the UI workflows. End-to-end Forgejo publication/deployment remains an owner acceptance step.

kiyi added 1 commit

2026-09-03 22:44:46 -05:00

feat(delivery): scan and sign containers and UDS releases

build-bundle.yml / feat(delivery): scan and sign containers and UDS releases (push) Failing after 0s

Details

build-container.yml / feat(delivery): scan and sign containers and UDS releases (push) Failing after 0s

Details

deploy-bundle.yml / feat(delivery): scan and sign containers and UDS releases (push) Failing after 0s

Details

build-bundle.yml / feat(delivery): scan and sign containers and UDS releases (pull_request) Failing after 0s

Details

build-container.yml / feat(delivery): scan and sign containers and UDS releases (pull_request) Failing after 0s

Details

deploy-bundle.yml / feat(delivery): scan and sign containers and UDS releases (pull_request) Failing after 0s

Details

Library checks / tests (pull_request) Has been cancelled

Details

f39d1c06ec

Build containers locally and upload signed evidence before registry pushes. Build UDS bundles from pinned manifests and verify signed payloads, current scans, mitigation expiry and cluster context before deployment. Document owner setup and recovery.

kiyi added 1 commit

2026-09-03 22:49:24 -05:00

test(delivery): verify evidence precedes registry publication

build-bundle.yml / test(delivery): verify evidence precedes registry publication (push) Failing after 0s

Details

deploy-bundle.yml / test(delivery): verify evidence precedes registry publication (push) Failing after 0s

Details

Library checks / tests (pull_request) Has been cancelled

Details

build-container.yml / test(delivery): verify evidence precedes registry publication (push) Failing after 0s

Details

build-bundle.yml / test(delivery): verify evidence precedes registry publication (pull_request) Failing after 0s