Fix release signing: SBOM egress + chart OCI push error handling - #82
Merged
Conversation
Two failures surfaced on the v0.4.9 release (image signing itself worked): - SBOM step failed with `getaddrinfo EAI_AGAIN raw.githubusercontent.com`: harden-runner blocked raw.githubusercontent.com, which anchore/sbom-action needs to fetch syft. Added it to the release-image allowlist. - Chart OCI `helm push` got 403 permission_denied (new-package write), but the `| tee` pipe masked the failure so the step passed with an empty digest and cosign then failed on `ghcr.io/.../ballast@`. Added `set -o pipefail` and a digest guard so a push failure fails the step loudly at the push. Also corrects the [0.4.9] CHANGELOG entry: that release signed the image but did not publish the SBOM/provenance or the OCI chart; moved those to [Unreleased]. The chart OCI push additionally needs a one-time GHCR package-creation/link step (org-side), tracked separately.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Docker Image Builtdocker pull ghcr.io/tight-line/ballast:pr-82-fa49c73Helm (values override)image:
repository: ghcr.io/tight-line/ballast
tag: "pr-82-fa49c73"Image expires ~15 days after PR closes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the two signing failures from the v0.4.9 release. Image signing itself worked (
cosign signsucceeded); these are the two downstream steps that didn't.1. Image SBOM step (blocked egress)
Generate SBOMfailed with:harden-runner (block mode) was denying
raw.githubusercontent.com, whichanchore/sbom-actionneeds to fetch syft. The allowlist hadrelease-assets/objectsbut notraw. Fix: addedraw.githubusercontent.com:443to therelease-imageallowlist. (Block mode doing its job, catching a real missing endpoint.)2. Chart OCI push (masked failure + real 403)
helm pushof the OCI chart actually failed:but the
| teepipe swallowed the non-zero exit, so the step "passed" with an empty digest, andcosign signthen failed onghcr.io/tight-line/charts/ballast@. Fix:set -o pipefail+ a digest guard, so a failed push fails the step directly with the real error.The image pushes fine because
ghcr.io/tight-line/ballastalready exists and is linked to the repo.ghcr.io/tight-line/charts/ballastis a brand-new package, and the repo'sGITHUB_TOKENwas denied permission to create it. This code change makes the failure legible but won't make the push succeed on its own, the package needs a one-time creation + repo link (details in the PR discussion / follow-up).CHANGELOG
Corrected the just-released
[0.4.9]entry: it claimed SBOM + provenance + signed OCI chart, but 0.4.9 only signed the image. Moved those to[Unreleased]. Flagging this since it edits a released entry, revert that part if you'd rather leave the record as-is.Validation
Same tag-only caveat:
release.ymlisn't exercised on this PR. Once this merges and the GHCR package permission is sorted, the next release should produce: signed image + SBOM + provenance, and signed OCI chart + provenance.