Skip to content

ci: attest provenance/SBOM and Grype-scan the built rock #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tonyandrewmeyer merged 5 commits into from
Jul 14, 2026
Merged

ci: attest provenance/SBOM and Grype-scan the built rock #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f62925b
ci: attest provenance/SBOM and Grype-scan the built rock
tonyandrewmeyer Jul 8, 2026
5ba895a
Merge branch 'master' into feat/attest-and-scan-rock
tonyandrewmeyer Jul 8, 2026
50dbce9
Merge branch 'master' into feat/attest-and-scan-rock
tonyandrewmeyer Jul 8, 2026
a568c35
Merge branch 'master' into feat/attest-and-scan-rock
tonyandrewmeyer Jul 14, 2026
b52099c
chore: bump version to 2.1.1
tonyandrewmeyer Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 46 additions & 1 deletion .github/workflows/publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,9 +59,54 @@ jobs:
with:
oci-archive-name: ${{ matrix.artifact-name }}

upload-ghcr:
attest-and-scan:
needs: [prepare, test]
runs-on: ubuntu-latest
strategy:
matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
fail-fast: false
permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: write
steps:
- name: Download rock artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ${{ matrix.artifact-name }}
path: ./rock

- name: Generate SBOM (Syft)
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
image: oci-archive:./rock/${{ matrix.artifact-name }}
format: spdx-json
output-file: ./sbom.spdx.json
upload-artifact: false
upload-release-assets: false

- name: Attest build provenance
uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
with:
subject-path: ./rock/${{ matrix.artifact-name }}

- name: Attest SBOM
uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
with:
subject-path: ./rock/${{ matrix.artifact-name }}
sbom-path: ./sbom.spdx.json

- name: Scan rock (Grype)
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
with:
sbom: ./sbom.spdx.json

@dwilding dwilding Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems that Grype can scan OCIs directly (with image). Presumably we separately need the SBOM, so it makes sense to scan the SBOM here too. Is one approach stronger/weaker than the other?

@tonyandrewmeyer tonyandrewmeyer Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both work. Scanning the SBOM keeps a single source of truth: the SBOM is the one we attest and publish, so a green Grype run against it means "the artefact whose SBOM we signed has no high+ vulnerabilities". There's no risk of the direct-image scan and the attested SBOM disagreeing.

The theoretical advantage of scanning the image directly is that Grype re-catalogues from scratch, so it might spot something Syft missed (like an unmanaged binary). For this rock that gap doesn't really exist, so I'd stay with the SBOM scan. If we ever add content Syft can't catalogue, it's worth switching to image: or running both.

fail-build: true
severity-cutoff: high

@dwilding dwilding Jul 14, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this cutoff a recommendation of our SSDLC?

@tonyandrewmeyer tonyandrewmeyer Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes (§Mandatory escalation and §Pre-release blocking).


upload-ghcr:
needs: [prepare, attest-and-scan]
runs-on: ubuntu-latest
strategy:
matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
fail-fast: false
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[project]
name = "api_demo_server"
version = "2.1.0"
version = "2.1.1"
description = "FastAPI demo server"
authors = [
{ name = "The Charm Tech team at Canonical Ltd." },
Expand Down
2 changes: 1 addition & 1 deletion rockcraft.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: api-demo-server
base: bare
build-base: ubuntu@24.04
run-user: _daemon_
version: "2.1.0"
version: "2.1.1"
summary: FastAPI demo server
description: A web server that can be integrated with a PostgreSQL database.
license: Apache-2.0
Expand Down
Loading