mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
381ed2a91f
* feat: add Admiral Hardened Build channel and business assurance surfaces Introduce Studio Saelix entitlement-backed Hardened Build switching, a single-flight image operation coordinator, Recovery Vault naming, Admiral Account settings, and typed Fleet update failures while preserving Community custom-repo and targetless pull-current updates. * fix: harden image-op paths and clear CI CodeQL/pilot flake Validate operation IDs before filesystem use, use hostname checks in Fleet fetch mocks, sanitize registry probe logs, and swallow expected TCP teardown errors in the pilot reverse-route post-handshake test. * fix: sanitize image-op docker config write and probe logs Allowlist-copy registry host keys and base64 auth before writing the temp DOCKER_CONFIG, and log registry probe failures with a fixed message so CodeQL no longer flags network-to-file and log-injection mediums. * fix: address Admiral Hardened Build audit blockers Expose imageChannel so hardened Fleet peers still POST for typed rejection, claim community updates before 202, terminalize helper failures, gate Hardened on paid, and align support/docs/e2e wording. * fix: terminalize image ops on helper survival and aborted claims * fix: prevent recreating persist from overwriting helper-exit failure * test: assert helper-exit failure lands before recreating persist * fix: keep current pointer when acknowledging a stale image operation
90 lines
3.3 KiB
YAML
90 lines
3.3 KiB
YAML
# Skeleton only. Do not create Studio-Saelix/sencho-hardened until explicit authorization is given.
|
|
name: Publish Hardened Build
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
source_ref:
|
|
description: Immutable source commit SHA
|
|
required: true
|
|
type: string
|
|
base_image_digest:
|
|
description: Immutable base-image digest
|
|
required: true
|
|
type: string
|
|
policy_revision:
|
|
description: Immutable scanner and OpenVEX policy revision
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
validate-inputs:
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
source_ref: ${{ steps.inputs.outputs.source_ref }}
|
|
base_image_digest: ${{ steps.inputs.outputs.base_image_digest }}
|
|
policy_revision: ${{ steps.inputs.outputs.policy_revision }}
|
|
steps:
|
|
# Replace every placeholder with a verified, full commit SHA before enabling.
|
|
- uses: actions/checkout@<FULL_40_CHARACTER_COMMIT_SHA>
|
|
with:
|
|
ref: ${{ inputs.source_ref }}
|
|
persist-credentials: false
|
|
- id: inputs
|
|
shell: bash
|
|
run: |
|
|
[[ "${{ inputs.source_ref }}" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ "${{ inputs.base_image_digest }}" =~ ^sha256:[0-9a-f]{64}$ ]]
|
|
[[ "${{ inputs.policy_revision }}" =~ ^[0-9a-f]{40}$ ]]
|
|
printf 'source_ref=%s\n' "${{ inputs.source_ref }}" >> "$GITHUB_OUTPUT"
|
|
printf 'base_image_digest=%s\n' "${{ inputs.base_image_digest }}" >> "$GITHUB_OUTPUT"
|
|
printf 'policy_revision=%s\n' "${{ inputs.policy_revision }}" >> "$GITHUB_OUTPUT"
|
|
|
|
build-and-assess:
|
|
needs: validate-inputs
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
platform: [linux/amd64, linux/arm64]
|
|
steps:
|
|
- uses: actions/checkout@<FULL_40_CHARACTER_COMMIT_SHA>
|
|
with:
|
|
ref: ${{ needs.validate-inputs.outputs.source_ref }}
|
|
persist-credentials: false
|
|
# TODO: install pinned Buildx and build from the source ref, lockfile,
|
|
# base-image digest, and platform. Export an OCI layout for scanning.
|
|
- name: Build immutable platform image
|
|
run: exit 1 # TODO: replace with a pinned Buildx invocation
|
|
# TODO: run a pinned Trivy image scan and evaluate the approved OpenVEX file.
|
|
- name: Gate Trivy and OpenVEX findings
|
|
run: exit 1 # TODO: fail exploitable critical or high findings
|
|
# TODO: generate SPDX and CycloneDX SBOMs plus SLSA provenance.
|
|
- name: Generate supply-chain attestations
|
|
run: exit 1 # TODO: replace with pinned tooling
|
|
# TODO: sign the immutable platform digest with Cosign keyless OIDC.
|
|
- name: Sign platform digest
|
|
run: exit 1 # TODO: replace with pinned Cosign tooling
|
|
|
|
publish-manifest:
|
|
needs: build-and-assess
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
environment: hardened-production
|
|
steps:
|
|
# TODO: assemble the approved multi-architecture manifest, attach SBOM
|
|
# and provenance, sign it, then publish only this immutable target:
|
|
# ghcr.io/studio-saelix/sencho-hardened
|
|
- name: Publish approved manifest
|
|
run: exit 1 # TODO: replace after explicit authorization
|