Skip to content

feat: add container image provenance attestation to shared workflow #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matthyx merged 4 commits into from
Jun 9, 2026
Merged

feat: add container image provenance attestation to shared workflow #87

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1a97874
feat: add container image provenance attestation to shared workflow
Varadraj75 Jun 5, 2026
d58870c
fix: use exact pushed image reference for attestation subject-name
Varadraj75 Jun 5, 2026
bca2019
fix: remove tag from subject-name as required by push-to-registry mode
Varadraj75 Jun 5, 2026
8d057e5
fix: update to actions/attest@v4.1.0 replacing deprecated attest-buil…
Varadraj75 Jun 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/incluster-comp-pr-merged.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,7 @@ jobs:
packages: write
contents: read
pull-requests: read
attestations: write
Comment thread
Varadraj75 marked this conversation as resolved.

@matthyx matthyx Jun 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verify caller permissions — attestations: write may not take effect here.

This is a reusable workflow (workflow_call). For reusable workflows the GITHUB_TOKEN permissions are capped by the caller: a permissions: block in the called workflow can only narrow what the caller grants, never widen it. So adding attestations: write here only has an effect if every caller (operator, kubevuln, storage, node-agent, synchronizer, http-request, prometheus-exporter) also grants attestations: write on the job that does uses: this workflow.

If a caller doesn't grant it, the attest step fails with a 403 when persisting the attestation to the GitHub attestations API — and it would only surface on a real release-labeled run, not in this PR's checks.

Please confirm the callers already grant attestations: write (same way they must already grant id-token: write for keyless cosign), or update them alongside this change.

@Varadraj75 Varadraj75 Jun 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Checked all 7 callers, none of them currently grant attestations: write. Will add it to all of them. Also noticed node-agent uses a local copy of the workflow instead of the shared one so it will need a separate update. Should I open separate PRs per repo or is there a preferred way to batch them?


steps:
# - name: Exit if not on master branch
Expand Down Expand Up @@ -167,6 +168,7 @@ jobs:
password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}

- name: Build and push
id: build
uses: docker/build-push-action@v6
with:
context: .
Expand All @@ -178,6 +180,13 @@ jobs:
cache-to: type=gha,mode=max
push: true

- name: Attest image provenance
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
with:
subject-name: ${{ inputs.IMAGE_NAME }}
subject-digest: ${{ steps.build.outputs.digest }}
push-to-registry: true
Comment thread
Varadraj75 marked this conversation as resolved.

- name: Install cosign
uses: sigstore/cosign-installer@main
with:
Expand Down
Loading