feat: reusable signing actions (sign-oci, sign-blob) + wire into pack-build-image - #46
Merged
Conversation
Adds a keyless (cosign/Fulcio/Rekor) sign-oci composite action that signs an OCI image by digest and attests build provenance + SPDX SBOM, plus a sign-smoke workflow that builds a throwaway ghcr image, signs/attests it, and verifies the signature, provenance attestation, and SBOM package count end-to-end.
Sign the packaged Helm chart .tgz with keyless cosign and attach the bundle + SBOM to the GitHub Release alongside the chart.
…ws; document reusable-workflow signer verification pack-build-image.yaml's sign-oci steps used `uses: ./.github/actions/sign-oci`, which resolves against the CALLING pack repo's checkout when invoked as a reusable workflow, not this repo -- so it would fail at a real pack release. Add the same job.workflow_repository@job.workflow_sha checkout that pack-release.yaml already uses for its Python script, and point both sign-oci steps and pack-release.yaml's sign-blob step at that checkout instead. Extend .github/actionlint.yaml's existing ignore-list workaround (actionlint doesn't yet know about job.workflow_repository/job.workflow_sha) to cover pack-build-image.yaml too. verifying-nebari-artifacts.md's gh attestation verify commands only passed --repo, which is not sufficient to pin the signer when the attestation was generated by a reusable workflow (per the gh CLI manual) -- add --signer-workflow pointing at pack-build-image.yaml or pack-release.yaml as appropriate, for every affected command. Repoint sign-smoke.yaml's trigger from the throwaway feature branch to push on main + pull_request (path-filtered to the sign actions/workflow), so it gets real post-merge regression coverage instead of only running on this branch.
dcmcand
marked this pull request as ready for review
July 17, 2026 13:35
Contributor
Author
End-to-end validation against a real pack (journey 8)Validated these reusable signing workflows by wiring them into Container images (
|
Adds a boolean `sync` input (default true) gating the sync-chart step, so callers can run the full release path (read version, pin tags, package, sign/attest, GitHub Release) without opening a PR in nebari-dev/helm-repository. Makes NEBARI_HELM_REPO_TOKEN required: false since it is only used by the sync step (needed only when sync is true). Default preserves existing behavior. Closes #47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sign-ociandsign-blobcomposite actions for keyless cosign signing + build provenance/SBOM attestation.sign-smoke.yamlto exercise both actions end-to-end (including negative tamper/wrong-identity cases) on push to this branch.sign-ociintopack-build-image.yaml: sign + attest images pushed to both GHCR and Quay after build, gated oninputs.push.Test plan
actionlintclean locally for all touched workflow filespre-commit run --all-filescleansign-smoke.yamlgreen on push (image + chart smoke tests, tamper/wrong-identity negative cases)lint-test.yamlactionlint job green on this PRpack-build-image.yamlsigning at a future pack release