[muhammad-tahir-nawaz]

Summary

The shared deployment and shared-registry-push workflows build images through the ARC runner's rootless BuildKit sidecar ($BUILDKIT_HOST) instead of a Docker daemon. The image is built to a tarball, scanned by Trivy, and pushed only if clean. Runners without the sidecar fall back to buildx's default driver.

Why

Security review follow-up: the Docker-in-Docker sidecar on the runners is privileged. Building through rootless BuildKit removes the last reason to keep it. The sidecar is already deployed on the dev, stage and prod runners.

QA Report

• No QA report required — CI workflow change, no user-facing API.

Integration Tests

• No integration tests required — CI workflow only; exercised by the next run of the workflow.

Dependencies

• Merge before the per-repo BuildKit PRs (RDE, kde, asset-bulk-uploader, catalog-bulk-uploader, worker-systems).
• Docker-in-Docker is removed from the runners in a later infrastructure change, after all of these have merged.

[Copilot]

Copilot review overview

🟡 Changes recommended

The pushed deployment artifact is not the scanned artifact, and the shared-registry path lacks the described Trivy gate.

Review effort: Balanced
Findings: 1 · 1 · 2

Open (4)

• Push rebuilds image artifact after scanning a different archive · New
• Shared registry path bypasses required Trivy scan gate · New
• Comment references nonexistent runner_label input · New
• Comment references nonexistent runner_label input · New

What changed in this PR

Routes container builds through rootless BuildKit sidecars, with a Docker-backed fallback.

Changes:

• Selects remote or Docker-container Buildx drivers.
• Scans a deployment image tarball before rebuilding and pushing.

File	Description
.github/​workflows/​deployment.yaml	Adds rootless building and tarball scanning.
.github/​workflows/​shared-registry-push.yaml	Adds Buildx builder selection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[greptile-apps]

Confidence Score: 4/5

[High risk] Changes how container images are built in CI pipelines.

The PR is not safe to merge until deployment pushes the image that passed the vulnerability scan.

Findings

1.  Pushed image bypasses scan ▶
2.   Mutable Buildx action reference ▶

Fix with agent prompt

### Issue 1
.github/workflows/deployment.yaml:182-186
If a floating base image or another build input changes between builds, Trivy approves `image.tar`, but this step builds again from the context and pushes a different image. The registry image can then contain dependencies that never passed the vulnerability scan. Push the scanned artifact instead of rebuilding it.

### Issue 2
.github/workflows/deployment.yaml:150
The new Buildx setup action uses the mutable `@v3` tag here and in the shared-registry workflow. If that tag is repointed, different code can run in credentialed build jobs without a workflow change. Pinning the action to a commit SHA would make the executed code reviewable.

**How this was verified:** Both setup steps use `@v3`, and the deployment job grants write and OIDC permissions before running the action.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The workflows select the ARC runner’s rootless BuildKit sidecar when available, with a docker-container fallback. Deployment now exports an image tarball for Trivy and performs a separate build to push; the shared-registry workflow adds the builder selection while retaining its best-effort push.

• The deployment push does not publish the artifact that Trivy scanned.
• The new Buildx setup references use mutable tags.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Deployment source] --> B[Build to image.tar]
  B --> C[Trivy scan]
  C -->|passes| D[Build again from source]
  D --> E[Push registry image]

Loading

_{Reviews (1) · Last reviewed commit: "chore: build images through the runner's..."}