Skip to content

fix: gate release tags behind container scan, add retag workflow#186

Merged
coopernetes merged 2 commits into
mainfrom
fix/docker-publish-grype-and-release-flow
May 1, 2026
Merged

fix: gate release tags behind container scan, add retag workflow#186
coopernetes merged 2 commits into
mainfrom
fix/docker-publish-grype-and-release-flow

Conversation

@coopernetes
Copy link
Copy Markdown
Member

Summary

  • Release flow: tag pushes now build to an ephemeral :vX.Y.Z-pending image, scan it, and only promote to :vX.Y.Z / :X.Y / :X / :latest after the scan passes. The ephemeral tag is deleted post-promotion. :latest now always points to a scan-clean image.
  • :edge continues to track every main commit without scanning — it's a mutable dev target and scan failures there are acceptable.
  • retag.yml: new workflow_dispatch workflow to retag any existing digest to arbitrary tags without rebuilding. Use for emergency promotions or re-pointing :latest to a previous known-good release.
  • grype 0.111.0 → 0.111.1: the root cause of the original scan-action failure was a bug in the pinned anchore/scan-action commit which constructs the download URL as /releases/0.111.0 instead of /releases/tag/v0.111.0. The fix bypasses the install script and downloads directly from the GitHub releases URL.
  • Applies the $GITHUB_PATH fix and tee-to-stdout report pattern from the CVE jobs.

Test plan

  • Push a v* tag and confirm: build pushes :vX.Y.Z-pending, scan runs against that digest, publish-release promotes to final tags, -pending tag is deleted from GHCR
  • Confirm :latest and :vX.Y.Z point to the same digest post-promotion
  • Confirm a scan failure on a tag push blocks publish-release (:latest not updated)
  • Trigger retag.yml manually with a known digest and confirm tags are created without a rebuild
  • Push to main and confirm only :edge is published, no scan runs

🤖 Generated with Claude Code

coopernetes and others added 2 commits May 1, 2026 10:22
On tag pushes, build to an ephemeral :vX.Y.Z-rc tag first, scan it, then
retag to :vX.Y.Z / :X.Y / :X / :latest only when the scan passes. This
ensures :latest always points to a clean image.

Edge continues to track every main commit without scanning — it's a mutable
dev target and scan failures there are acceptable.

Also bumps GRYPE_VERSION from 0.111.0 (non-existent release) to 0.111.1,
applies the same PATH fix and tee-to-stdout report approach from the CVE jobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Release flow for tag pushes:
- Build to ephemeral :vX.Y.Z-pending tag
- Scan by digest (fails build on high CVEs with a fix)
- On scan pass: retag to :vX.Y.Z / :X.Y / :X / :latest, delete -pending

:edge continues to track every main commit without scanning — mutable dev
target, scan failures acceptable there.

:latest now always points to a scan-clean release image.

Also adds retag.yml — workflow_dispatch to retag any digest to arbitrary
tags without rebuilding, for emergency promotions and re-pointing :latest.

Bumps GRYPE_VERSION 0.111.0 → 0.111.1. The root cause of the original
scan-action failure was a bug in that pinned commit of anchore/scan-action
which constructs the download URL as /releases/0.111.0 instead of
/releases/tag/v0.111.0, causing a 404. The fix bypasses the install script
entirely and downloads directly from the GitHub releases URL.

Applies PATH fix and tee-to-stdout report from the CVE jobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@coopernetes coopernetes enabled auto-merge (squash) May 1, 2026 14:37
@coopernetes coopernetes merged commit 0080938 into main May 1, 2026
13 checks passed
@coopernetes coopernetes deleted the fix/docker-publish-grype-and-release-flow branch May 1, 2026 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant