mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-08-28 05:25:25 +00:00
ac9246cfd3
* ci(docker): mirror signed images to Docker Hub alongside GHCR
docker.yml now publishes to docker.io/abhigyanpatwari/gitnexus{,-web} in
the same build step as the existing GHCR push, so both registries receive
the same digest, the same Cosign keyless signature, and the same SBOM /
build-provenance attestations. The Docker Hub login uses new repo secrets
DOCKERHUB_USERNAME / DOCKERHUB_TOKEN (scoped PAT, not account password).
Supply-chain guarantees carry over unchanged: the signing loop iterates
metadata-action's full tag set, so Docker Hub tags get signed at the
identical digest under the same docker.yml@refs/tags/v* identity. The
ClusterImagePolicy is extended with docker.io / index.docker.io / bare-
namespace globs so admission cannot be sidestepped by registry-prefix
choice. README and .env.example document both registries; RC section in
CONTRIBUTING.md notes the Docker Hub mirror tag.
Closes #1027
* ci(docker): publish to akonlabs Docker Hub namespace; add PR dry-run CI
- Hardcode `akonlabs` as the Docker Hub namespace in metadata-action and
both attestation subject-names (Docker Hub org differs from GitHub org
`abhigyanpatwari`, so `github.repository_owner` would produce the wrong ref)
- Update docs (.env.example, README, CONTRIBUTING) and the Kubernetes
ClusterImagePolicy globs to reference `akonlabs/gitnexus{,-web}`
- Add `pull_request` trigger so the image build runs as CI on every PR
(build only — no push, sign, or attestation)
- Add `workflow_dispatch` with `dry_run: boolean` (default true) for
manual build-only runs; all publish steps gated on
`github.event_name != 'pull_request' && !inputs.dry_run`
76 lines
3.5 KiB
YAML
76 lines
3.5 KiB
YAML
# Sigstore policy-controller ClusterImagePolicy for GitNexus container images.
|
|
#
|
|
# This enforces — at admission time — that every Pod pulling a
|
|
# `ghcr.io/abhigyanpatwari/gitnexus` or `gitnexus-web` image is using a build
|
|
# that was Cosign-keyless-signed by this repository's `docker.yml` workflow
|
|
# running from a `vX.Y.Z` git tag. Unsigned images, images signed by other
|
|
# workflows, and images signed from unprotected refs (e.g. `main`, PR branches)
|
|
# are rejected.
|
|
#
|
|
# Prerequisites
|
|
# -------------
|
|
# 1. Install the Sigstore policy-controller in your cluster (Helm):
|
|
#
|
|
# helm repo add sigstore https://sigstore.github.io/helm-charts
|
|
# helm repo update
|
|
# helm install policy-controller -n cosign-system --create-namespace \
|
|
# sigstore/policy-controller
|
|
#
|
|
# 2. Opt namespaces in to verification:
|
|
#
|
|
# kubectl label namespace <your-ns> policy.sigstore.dev/include=true
|
|
#
|
|
# 3. Apply this policy:
|
|
#
|
|
# kubectl apply -f deploy/kubernetes/cluster-image-policy.yaml
|
|
#
|
|
# After this, `kubectl run --image=ghcr.io/abhigyanpatwari/gitnexus:<tag>` in
|
|
# any opted-in namespace will only succeed if the image carries a valid
|
|
# Sigstore signature with the pinned identity.
|
|
#
|
|
# References
|
|
# - https://docs.sigstore.dev/policy-controller/overview/
|
|
# - https://github.com/sigstore/policy-controller
|
|
apiVersion: policy.sigstore.dev/v1beta1
|
|
kind: ClusterImagePolicy
|
|
metadata:
|
|
name: gitnexus-signed-images
|
|
spec:
|
|
# Apply to both published GitNexus images on both registries. Image
|
|
# references always carry a tag or digest at admission time, so these globs
|
|
# cover every `gitnexus:<tag>`, `gitnexus@sha256:...`, `gitnexus-web:<tag>`,
|
|
# and `gitnexus-web@sha256:...` reference on either GHCR or Docker Hub.
|
|
# The Docker Hub images are byte-for-byte mirrors of the GHCR images (same
|
|
# build, same digest, same Cosign signature), so the same keyless identity
|
|
# authority verifies both.
|
|
images:
|
|
- glob: 'ghcr.io/abhigyanpatwari/gitnexus*'
|
|
# Docker Hub references can appear in three forms at admission time
|
|
# (`docker.io/...`, `index.docker.io/...`, and bare `akonlabs/...` with
|
|
# the default registry implied). List all three so the policy cannot be
|
|
# sidestepped by the choice of registry prefix. The Docker Hub namespace
|
|
# is `akonlabs` rather than `abhigyanpatwari` because the Docker Hub org
|
|
# differs from the GitHub org.
|
|
- glob: 'docker.io/akonlabs/gitnexus*'
|
|
- glob: 'index.docker.io/akonlabs/gitnexus*'
|
|
- glob: 'akonlabs/gitnexus*'
|
|
authorities:
|
|
- name: gitnexus-cosign-keyless
|
|
keyless:
|
|
# Public-good Sigstore Fulcio root.
|
|
url: https://fulcio.sigstore.dev
|
|
identities:
|
|
# Pin both the OIDC issuer (GitHub Actions) AND the exact workflow
|
|
# path running from a `vX.Y.Z` (or `vX.Y.Z-prerelease`) tag. Same
|
|
# regex the README's `cosign verify` example uses; it rejects:
|
|
# * unsigned images
|
|
# * signatures from any other repo / workflow
|
|
# * signatures from non-tag refs (main, PRs, release branches)
|
|
# * signatures from arbitrary non-semver tags
|
|
- issuer: https://token.actions.githubusercontent.com
|
|
subjectRegExp: ^https://github\.com/abhigyanpatwari/GitNexus/\.github/workflows/docker\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$
|
|
# Cross-check the signature against the public Rekor transparency log,
|
|
# so an attacker who briefly compromised Fulcio cannot retroactively
|
|
# mint a signature without leaving a public, append-only audit record.
|
|
ctlog:
|
|
url: https://rekor.sigstore.dev
|