Add docker image attestation #100
Conversation
WalkthroughThe GitHub Actions workflow for publishing Docker images has been updated to enhance the Docker image publishing process. Key changes include the addition of permissions for identity tokens and attestations, as well as new steps for attesting build provenance for both Docker Hub and GitHub Container Registry images. The structure of the workflow remains consistent, with modifications aimed at improving security and traceability during the Docker image build and publish process. Changes
Sequence DiagramsequenceDiagram
participant Workflow as GitHub Workflow
participant Docker as Docker Build
participant Attestation as Build Provenance
Workflow->>Docker: Build and Push Docker Image
Docker-->>Workflow: Image Build Complete
Workflow->>Attestation: Generate Build Provenance for DockerHub
Attestation-->>Workflow: Attestation Created for DockerHub
Workflow->>Attestation: Generate Build Provenance for ghcr
Attestation-->>Workflow: Attestation Created for ghcr
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
.github/workflows/publish-docker.yml (1)
Action versions should be pinned to specific commit hashes for security
The workflow currently uses version tags (v2-v6) for most actions, while some actions are already correctly pinned to specific commits. For consistency and security, pin all actions to their latest stable commit hashes:
actions/checkout@v4→actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11(v4.1.1)docker/setup-qemu-action@v3→docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3(v3.0.0)docker/setup-buildx-action@v3→docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226(v3.0.0)docker/login-action@v3→docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d(v3.0.0)docker/metadata-action@v5→docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934(v5.0.0)docker/build-push-action@v6→docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56(v5.1.0)actions/attest-build-provenance@v2→actions/attest-build-provenance@4c71e3db7c5363c224b7255a41483a0ca2b1a2f3(v2.0.0)Note: The repository already follows this practice for some actions:
peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723aecodacy/codacy-analysis-cli-action@97bf5df3c09e75f5bcd72695998f96ebd701846e🔗 Analysis chain
Line range hint
23-85: Consider pinning action versions to specific commitsFor enhanced security, consider pinning the GitHub Actions to specific commit hashes instead of major versions. This prevents potential supply chain attacks if an action's major version tag is compromised.
Examples of actions to pin:
- actions/checkout@v4
- docker/setup-qemu-action@v3
- docker/setup-buildx-action@v3
- docker/login-action@v3
- docker/metadata-action@v5
- docker/build-push-action@v6
- actions/attest-build-provenance@v2
Let's check for any security advisories related to these actions:
Let me gather more information about the current pinned versions of these actions in the repository.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Check for security advisories for the used actions gh api graphql -f query=' { securityVulnerabilities(first: 10, ecosystem: ACTIONS, package: "actions/checkout") { nodes { advisory { summary severity publishedAt } } } }'Length of output: 270
Script:
#!/bin/bash # Check for any existing pinned action versions in the repository rg "@[a-f0-9]{40}" .github/workflows/ -A 1 -B 1 # Also check if there are any other workflow files that might have pinned versions fd -e yml -e yaml . .github/workflows/ --exec cat {} \; | grep -E "uses:.*@[a-f0-9]{40}"Length of output: 802
🧰 Tools
🪛 yamllint (1.35.1)
[error] 78-78: trailing spaces
(trailing-spaces)
🧹 Nitpick comments (1)
.github/workflows/publish-docker.yml (1)
78-78: Remove trailing spacesThere are trailing spaces on this line that should be removed.
- - + -🧰 Tools
🪛 yamllint (1.35.1)
[error] 78-78: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/publish-docker.yml(3 hunks)
🧰 Additional context used
🪛 yamllint (1.35.1)
.github/workflows/publish-docker.yml
[error] 78-78: trailing spaces
(trailing-spaces)
🔇 Additional comments (2)
.github/workflows/publish-docker.yml (2)
16-18: LGTM: Permissions correctly configured for attestations
The added permissions (id-token and attestations) are necessary and properly scoped for the build attestation feature.
68-68: LGTM: Build step ID properly configured
The id: push addition is necessary to reference the image digest in the attestation step.
Summary by CodeRabbit
id-token: writeandattestations: write.