push signed artifacts to new connector registry #34

gontzess · 2025-12-01T21:45:24Z

Updated connector release workflow for signing artifacts and pushing to the new c1 connector registry. The registry will provide a central, consistent way to distribute binaries and container images to customers across all public and private connectors.

This PR makes a number of changes and and will necessitate a new major release version bump.

new goreleaser binary config file that signs binaries with cosign, generates sboms, checksums, then uploads to the registry s3 using OIDC
new consolidated goreleaser docker config file that signs and builds a multi-arch image, lambda image, and digests - both images are conditional based on input bools
dockerfiles are now build from centralized templates here in this repo, not used from files in each repo
go scripts for building and uploading a release manifest.json the registry s3 using
protos for consistent manifest and stable structs in this workflow and available for other repos/scripts to import for use

For a connector repo to upgrade to the new workflow:

needs to be added in ops for OIDC permissions
needs to upgrade to the new pending release workflow verison (likely v4)
nice to have but not required: remove the Dockerfile and Dockerfile.lambda from it's own repo since they're no longer used in v4+

Summary by CodeRabbit

New Features
- Added support for artifact release manifests capturing version, name, organization, and semantic version.
- Tracks release and update timestamps for artifacts.
- Stores per-artifact attachments: assets with media type, size, checksum, and SBOM links.
- Records release signatures, certificates, and container image references.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

coderabbitai · 2025-12-01T21:45:34Z

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (5)

.Dockerfile-lambda-template is excluded by none and included by none
.github/workflows/release.yaml is excluded by none and included by none
.goreleaser-docker-template-signing.yaml is excluded by none and included by none
README.md is excluded by none and included by none
cmd/extract-images/main.go is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Adds a Go module declaration and dependency; introduces protobuf schemas defining artifact manifests (Manifest, Asset, Image) and a Stable message with timestamps for immutable release metadata and per-asset SBOM/signature/certificate references.

Changes

Cohort / File(s)	Summary
Module configuration `go.mod`	Adds module `github.com/ConductorOne/github-workflows`, sets Go version to `1.25.2`, and adds dependency `google.golang.org/protobuf v1.36.5`.
Artifact protobufs `proto/artifacts/v1/manifest.proto`, `proto/artifacts/v1/stable.proto`	Adds `Manifest`, `Asset`, and `Image` messages in `manifest.proto` (versioning, assets map, images map, signature/certificate/SBOM hrefs). Adds `Stable` message in `stable.proto` mirroring Manifest with an additional `updated_at` timestamp; imports and options set (go_package, api_level).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Verify proto field numbers, types, and imports (google.protobuf.Timestamp).
Confirm Stable correctly references Asset/Image from manifest.proto and imported symbols.
Check go_package and API feature options for correctness and expected generated paths.
Validate semantic comments and timestamp semantics (released_at vs updated_at).

Poem

🐰 I hopped through code, so spry and fleet,
Brought manifests and SBOMs to meet,
Images, assets, timestamps bright,
Signatures tucked in snug and tight,
A joyful patch — a carrot treat! 🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: introducing infrastructure to push signed artifacts to a new connector registry. It aligns with the core PR objective of adding a connector release workflow with artifact signing and registry uploads.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

kans · 2025-12-02T22:28:52Z

.goreleaser-docker-template-signing.yaml

+      - amd64
+      - arm64
+    tags:
+      - "baton_lambda_support"


Consolidated docker template for GoReleaser >= 2.12 with optional lambda build and signing

Do we actually want to bundle in the lambda infra into order containers? Its an extra 10-15MB IIRC and highly specialized for our lambda deployments.

These are still separate images, see lines 21 and 41 below. I've consolidated the goreleaser template so that they're in one file (and one GitHub job).

Note, the amd64 and arm64 arch are now bundled into a single image for GHCR (corresponding to image from line 21).

I'm wondering if the baton_lambda_support tag here is correct tho for the build step

Lets fix this in a different PR

kans · 2025-12-04T22:32:41Z

.github/workflows/release.yaml

+      msi:
+        required: false
+        type: boolean
+        default: false


When do we not want MSIs?

im going to remove this flag since i'm not sure yet about this, plus this functionality didnt make it into this PR anyways

kans · 2025-12-04T22:44:41Z

.github/workflows/release.yaml

+        run: |
+          set -euo pipefail
+          cd dist
+          cosign sign-blob --yes "manifest.json" \


Did we verify the signatures?

kans · 2025-12-04T22:45:59Z

.github/workflows/release.yaml

            RESPONSE=$(aws lambda invoke \
-              --function-name "${{ github.event.repository.name }}-releases" \
-              --payload "{\"repository\":\"${{ github.event.repository.full_name }}\", \"tag\":\"${{ inputs.tag }}\"}" \
+              --function-name "${{ github.event.repository.owner.login }}-${{ github.event.repository.name }}-artifact-releases" \


Is this correct?

yes. basically it was wrong, but we weren'tm using it anyways. the lambda just hardcodes conductorone

kans · 2025-12-04T22:49:05Z

This PR is hard to review for correctness, but thats easy to verify:

TODOS:

Do the containers work?
Do the lambdas still work?
Are the sigs valid?
Do the other things work?

kans · 2025-12-08T22:17:03Z

cmd/extract-images/main.go

+	}
+
+	if !foundIndex {
+		content, _ := os.ReadFile(digestFile)


gontzess added 3 commits November 11, 2025 10:17

new binaries goreleaser job and upload to experiment s3

9b8cbf2

build and sign multi-arch images, add to manifest

b892306

aws prod

365b991

protos and go scripts

6e5818a

gontzess force-pushed the gontzess/duct-12735-binaries-registry-1 branch from 8ec90c8 to 6e5818a Compare December 1, 2025 21:47

gontzess requested review from ggreer, kans and laurenleach December 1, 2025 21:47

kans reviewed Dec 2, 2025

View reviewed changes

build dockerfiles in _workflows

e8d4845

gontzess force-pushed the gontzess/duct-12735-binaries-registry-1 branch from 3e8b1ee to 4c6f3df Compare December 3, 2025 21:57

kans reviewed Dec 4, 2025

View reviewed changes

use single arch for lambda docker

c74e9cf

gontzess force-pushed the gontzess/duct-12735-binaries-registry-1 branch from 2ab69dd to c74e9cf Compare December 8, 2025 19:54

gontzess added 2 commits December 8, 2025 16:32

shorter role name

c106303

remove msi flag for now

c2c73c5

kans reviewed Dec 8, 2025

View reviewed changes

kans approved these changes Dec 8, 2025

View reviewed changes

file reading

26d3d9e

gontzess merged commit 218adc2 into main Dec 8, 2025
1 check passed

gontzess deleted the gontzess/duct-12735-binaries-registry-1 branch December 8, 2025 22:49

This was referenced Dec 18, 2025

push docker images to public ECR #37

Merged

provenance attestations for binaries and images #39

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

push signed artifacts to new connector registry #34

push signed artifacts to new connector registry #34

Uh oh!

gontzess commented Dec 1, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Dec 1, 2025 •

edited

Loading

Review skipped

Uh oh!

kans Dec 2, 2025

Uh oh!

gontzess Dec 2, 2025

Uh oh!

kans Dec 8, 2025

Uh oh!

kans Dec 4, 2025

Uh oh!

gontzess Dec 8, 2025

Uh oh!

kans Dec 4, 2025

Uh oh!

kans Dec 4, 2025

Uh oh!

gontzess Dec 8, 2025

Uh oh!

kans commented Dec 4, 2025 •

edited by gontzess

Loading

Uh oh!

kans Dec 8, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

push signed artifacts to new connector registry #34

push signed artifacts to new connector registry #34

Uh oh!

Conversation

gontzess commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Estimated code review effort

Poem

Pre-merge checks and finishing touches

Uh oh!

Choose a reason for hiding this comment

Consolidated docker template for GoReleaser >= 2.12 with optional lambda build and signing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kans commented Dec 4, 2025 • edited by gontzess Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gontzess commented Dec 1, 2025 •

edited

Loading

coderabbitai bot commented Dec 1, 2025 •

edited

Loading

kans commented Dec 4, 2025 •

edited by gontzess

Loading