jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-11 20:01:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Harden dependency and image security checks

Browse Source 
Signed-off-by: Jordan Mecom <jm@squareup.com>
This commit is contained in:
Jordan Mecom
2026-08-20 13:17:37 -07:00
parent cd0d33f085
commit 7ebc8382cc
19 changed files with 664 additions and 393 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
.github/workflows/docker.yml vendored
View File

@@ -175,12 +175,24 @@ jobs:
# Push by digest, not by tag — the merge job assembles the tags
# into one multi-arch manifest. This is what makes the native-arm
# matrix possible.
outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
outputs: ${{ github.event_name == 'pull_request' && format('type=docker,name=buzz-ci:release-{0}', matrix.arch) || format('type=image,name={0},push-by-digest=true,name-canonical=true,push=true', env.IMAGE_NAME) }}
cache-from: |
type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
cache-to: |
${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
- name: Scan release image
env:
LOCAL_IMAGE: buzz-ci:release-${{ matrix.arch }}
REMOTE_IMAGE: ${{ env.IMAGE_NAME }}@${{ steps.build-release.outputs.digest }}
run: |
. ./bin/activate-hermit
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
scripts/scan-container-image.sh "$LOCAL_IMAGE"
else
scripts/scan-container-image.sh "$REMOTE_IMAGE"
fi
- name: Build and push debug image by digest
id: build-debug
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
@@ -190,10 +202,22 @@ jobs:
target: runtime-debug
platforms: ${{ matrix.platform }}
labels: ${{ steps.meta.outputs.labels }}
outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
outputs: ${{ github.event_name == 'pull_request' && format('type=docker,name=buzz-ci:debug-{0}', matrix.arch) || format('type=image,name={0},push-by-digest=true,name-canonical=true,push=true', env.IMAGE_NAME) }}
cache-from: |
type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
- name: Scan debug image
env:
LOCAL_IMAGE: buzz-ci:debug-${{ matrix.arch }}
REMOTE_IMAGE: ${{ env.IMAGE_NAME }}@${{ steps.build-debug.outputs.digest }}
run: |
. ./bin/activate-hermit
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
scripts/scan-container-image.sh "$LOCAL_IMAGE"
else
scripts/scan-container-image.sh "$REMOTE_IMAGE"
fi
- name: Export release and debug digests
if: github.event_name != 'pull_request'
env:
@@ -400,9 +424,20 @@ jobs:
file: ./Dockerfile.push-gateway
platforms: ${{ matrix.platform }}
labels: ${{ steps.meta.outputs.labels }}
outputs: type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
outputs: ${{ github.event_name == 'pull_request' && format('type=docker,name=buzz-push-gateway-ci:{0}', matrix.arch) || 'type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=true' }}
cache-from: type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:${{ matrix.arch }}
cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
- name: Scan push gateway image
env:
LOCAL_IMAGE: buzz-push-gateway-ci:${{ matrix.arch }}
REMOTE_IMAGE: ghcr.io/block/buzz-push-gateway@${{ steps.build.outputs.digest }}
run: |
. ./bin/activate-hermit
if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
scripts/scan-container-image.sh "$LOCAL_IMAGE"
else
scripts/scan-container-image.sh "$REMOTE_IMAGE"
fi
- name: Export digest
if: github.event_name != 'pull_request'
env: