release: publish protected multi-architecture Codex Security images - #17
release: publish protected multi-architecture Codex Security images#17dc-oai wants to merge 12 commits into
Conversation
mldangelo-oai
left a comment
mldangelo-oai
left a comment
There was a problem hiding this comment.
Thanks for putting this together — there is a lot to like here, especially the native amd64/arm64 validation, SHA-pinned actions, digest-based platform builds, SBOM generation, and the updated host-aware AppArmor fallback with regression coverage.
I took another pass on the latest head and compared the publicly visible release flow with Promptfoo’s public Docker workflow. I left a few inline suggestions that I think would make the first release safer and more predictable: explicitly handle first-time GHCR visibility, only promote stable image tags after attestation and smoke checks have passed, serialize all publication paths while protecting version-tag stability, and keep provenance signing in a small dedicated job.
As an optional follow-up, a deterministic successful bulk-scan smoke test would also provide stronger coverage alongside the existing empty-CSV regression.
Really appreciate the attention to hardened defaults and the improvement to sandbox selection — this is close, and I think the small release-flow adjustments would make it much more robust.
| run: | | ||
| set -euo pipefail | ||
| docker logout ghcr.io | ||
| if ! docker pull "$IMAGE:$VERSION"; then |
There was a problem hiding this comment.
Could we explicitly document or preflight the first-time public-package bootstrap here? Newly created GHCR packages start out private, so an initial publication can reach this anonymous pull only after platform images and tags have already been pushed, then fail. Making the visibility/bootstrap prerequisite explicit before promotion would give the first release a clear, predictable success path.
| references+=("$IMAGE@sha256:$digest") | ||
| done | ||
|
|
||
| docker buildx imagetools create \ |
There was a problem hiding this comment.
Would it make sense to create or select the manifest by digest first, run attestation and the public-pull/Compose checks against that candidate, and promote the version and latest tags only after everything succeeds? At the moment a later failure can leave the user-facing tags published even though the release failed.
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: container-release-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }} |
There was a problem hiding this comment.
Small release-race concern: the concurrency key uses the ref, so a manual main run and a version-tag run can both publish to the same image/version/latest at the same time. Could we use a shared repository/image-level group for non-PR publication, and avoid overwriting an already published version? Promptfoo’s public Docker workflow uses a shared publishing group for this reason.
| - publish-platform | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 30 | ||
| permissions: |
There was a problem hiding this comment.
Could we move provenance generation into its own minimal job, passing in the verified manifest digest as an output? That would keep provenance-signing permissions separate from repository checkout, registry promotion, and Compose execution, and follows the narrowly scoped attestation-job pattern in Promptfoo’s public workflow.
|
Thanks, Michael — addressed the GHCR visibility preflight, verify-and-attest-before-promotion flow, shared release concurrency and immutable version tags, and dedicated least-privilege signing job. I’ll keep the successful bulk-scan smoke test as a follow-up. |
mldangelo-oai
left a comment
mldangelo-oai
left a comment
There was a problem hiding this comment.
Please see the comments on the docs. Willing to give this a try. Thank you so much @dc-oai
| await security.close(); | ||
| ``` | ||
|
|
||
| ## Containerized bulk scans |
There was a problem hiding this comment.
can we move most of this to the developer docs
| payments,https://github.com/example/payments.git,0123456789abcdef0123456789abcdef01234567 | ||
| ``` | ||
|
|
||
| Once the approved image has been published, prepare private results and |
2 participants
Summary
Prepare the official
0.1.1Codex Security image for externally distributed, noninteractive, resumable CSV repository scans.0.1.1SDK release.linux/amd64andlinux/arm64on native runners.no-new-privileges, narrowed seccomp, private mounted authentication, and persistent scan results.Protected publication
main, and require the image tag to match the exact public CLI version.ghcr.io/openai/codex-securityhas been created, made publicly readable, and granted access to this repository.containerenvironment.latesttags.Verification
amd64, Linuxarm64, Ubuntu, macOS, and Windows.@openai/codex-security@0.1.1tarball; verified the public SDK import, installed CLI, all 94 bundled scanner-plugin files, all 178 expected package entries, and absence of unexpected internal content.actionlint; TypeScript and formatting validation run against the exact0.1.1package.Opening or merging this PR does not create the GHCR package or publish an image. First publication still requires an authorized package administrator and independent protected-environment approval.
Source-of-truth companion: https://github.com/openai/openai/pull/1199105.