ci: add darwin/arm64 target + artifact attestations#38
Merged
Conversation
- release.yml build matrix: all 4 mandatory targets (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64) with fail-fast: false - new attest-binaries job: SBOM via anchore/sbom-action@v0, provenance via actions/attest-build-provenance@v4, sbom attestation via actions/attest-sbom@v4 - docker job: multi-arch (linux/amd64, linux/arm64) + QEMU + provenance attestation on GHCR image push - ci.yml docker job: multi-arch build (no push, no attestation) - release job gated on attest-binaries completion Closes #32
Contributor
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 53 minutes and 3 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe CI/CD workflows are expanded to support multi-architecture builds (Linux and Darwin on amd64/arm64) and include provenance attestation capabilities. The Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 143-146: The release job currently depends on the docker job via
the needs: [build, docker, attest-binaries] declaration; remove "docker" from
the needs array in the release job so the job only depends on build and
attest-binaries (i.e., change needs to [build, attest-binaries]) so GitHub
Release is not blocked by a failing docker job, or alternatively implement an
explicit conditional/optional gating (e.g., separate workflow or conditional
step) if you intentionally want the image push to be non-blocking but still
attempted.
- Around line 53-82: The attest-binaries job includes an unnecessary
actions/checkout@v6 step and currently generates one SBOM for the entire
artifacts/ directory which is then attested against multiple subjects; remove
the actions/checkout step from the attest-binaries job to speed the workflow,
and either (A) keep the current anchore/sbom-action usage if a single
multi-artifact SBOM is intended or (B) change the SBOM generation to produce
per-subject SBOMs and invoke anchore/sbom-action (or loop) per
artifacts/pebblify-* before calling actions/attest-sbom for each corresponding
sbom, updating subject-path and sbom-path to match each binary; key symbols to
edit: job name "attest-binaries", the "uses: actions/checkout@v6" step, the
"uses: anchore/sbom-action@v0" step with "path: artifacts/", and the "uses:
actions/attest-sbom@v4" step with "subject-path: artifacts/pebblify-*" and
"sbom-path: sbom.spdx.json".
- Around line 7-11: Current workflow grants elevated permissions at the root
level; move the permissions block into each job and set least-privilege values:
for the attest-binaries job grant attestations: write, id-token: write, and
contents: read; for the docker job grant packages: write, attestations: write,
and id-token: write; for the release job grant contents: write only; and for
build (and any other jobs that only need repo read access) set contents: read.
Update the workflow to remove the root-level permissions block and add per-job
permissions entries for job names attest-binaries, docker, release, and build
using the permission keys id-token, attestations, packages, and contents as
specified.
- Around line 71-76: The workflow step named "Generate SBOM" currently uses the
floating tag anchore/sbom-action@v0; update the uses entry to a pinned reference
(either a specific semver tag like anchore/sbom-action@v0.24.0 or a commit SHA)
so the action version is immutable; edit the step that contains uses:
anchore/sbom-action@v0 and replace the tag with the chosen `@vX.Y.Z` or
@<commit-sha>, test the workflow runs to ensure SBOM generation and output-file:
sbom.spdx.json still work.
- Around line 136-141: The attestation step uses subject-name: ghcr.io/${{
github.repository }} which can contain uppercase letters (e.g.,
Dockermint/pebblify) and must be lowercased; change subject-name to reference a
lowercased repository string (either use the workflow expression with a lower
filter if available, or add a preparatory step that sets an output like
steps.lowercase.outputs.repo by lowercasing github.repository and then set
subject-name to ghcr.io/${{ steps.lowercase.outputs.repo }} while keeping
subject-digest: ${{ steps.push.outputs.digest }} and push-to-registry: true so
the attestation references the exact image pushed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 00a88c4f-847a-428b-bfbf-759eeef84515
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/release.yml
5 findings fixed: 1. release job: drop `docker` from needs, keep [build, attest-binaries]. Binary release no longer blocked by docker push failures; docker runs in parallel as supplementary artifact. 2. attest-binaries: remove unnecessary actions/checkout step (job only processes downloaded artifacts, no repo files needed). 3. Per-job least-privilege permissions replace root-level block: - build: contents:read - attest-binaries: id-token:write, attestations:write, contents:read - docker: packages:write, attestations:write, id-token:write, contents:read - release: contents:write 4. Pin anchore/sbom-action to SHA e22c389... (v0.24.0) for immutability. Replaces floating @v0 tag. 5. Lowercase ghcr.io image reference. Dockermint/pebblify contains uppercase D; OCI registries require lowercase. Add preparatory `Lowercase repo` step in docker job, use its output for both metadata-action images and attest subject-name. Part of #32
Member
Author
CodeRabbit findings addressed in a3769a7All 5 actionable comments resolved in a single fix commit:
Deferred to v0.5.0: per-subject SBOMs (current impl = single multi-artifact SBOM, acceptable per spec). @coderabbitai ready for re-review. |
Contributor
|
Kicking off the re-review now. 🧠 Learnings used✅ Actions performedFull review triggered. |
This was referenced Apr 18, 2026
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #32
Summary by CodeRabbit
New Features
Chores