Skip to content

feat(ci): attest build provenance#255

Merged
hyperpolymath merged 1 commit into
mainfrom
feat/attest-build-provenance
Jun 25, 2026
Merged

feat(ci): attest build provenance#255
hyperpolymath merged 1 commit into
mainfrom
feat/attest-build-provenance

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Estate attestation rollout

Adds GitHub native build-provenance attestation to the container publish workflow (.github/workflows/container-publish.yml).

Push mechanism: Podman (podman build + podman push to ghcr.io).

How the digest is obtained: the GHCR push now runs with podman push --digestfile=/tmp/ghcr-digest, which writes the real sha256:... digest of the pushed manifest. That value is exported as the push step output and fed to the attestation as subject-digest — no guessing, the digest is the one the registry received.

Changes:

  • Added id-token: write + attestations: write to the job permissions.
  • Captured the pushed digest via --digestfile.
  • Added an actions/attest-build-provenance@e8998f94… (v2, pinned) step with push-to-registry: true.

Verify a published image with:

gh attest verify oci://ghcr.io/hyperpolymath/boj-server:<tag> --repo hyperpolymath/boj-server

🤖 Generated with Claude Code

Add GitHub native build-provenance attestation to the container publish
workflow. The image is built and pushed with Podman; the pushed manifest
digest is captured via 'podman push --digestfile' and bound to the
attestation via actions/attest-build-provenance.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@hyperpolymath hyperpolymath merged commit 426a435 into main Jun 25, 2026
19 checks passed
@hyperpolymath hyperpolymath deleted the feat/attest-build-provenance branch June 25, 2026 08:41
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 219 issues detected

Severity Count
🔴 Critical 15
🟠 High 131
🟡 Medium 73

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages-deploy.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/ephapax-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server/boj-server/cartridges/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant