fix(ci): restore GHCR workflow startup - #1715
Conversation
📝 WalkthroughWalkthroughThe workflow is updated to migrate GitHub App authentication from ChangesGHCR Integration Workflow Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: feba57d9d9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| steps: | ||
| - name: Attest build provenance | ||
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4 | ||
| uses: actions/attest-build-provenance@b3e506e8c389afc651c5bacf2b8f2a1ea0557215 # v4 |
There was a problem hiding this comment.
This SHA does not correspond to the actions/attest-build-provenance v4 tag; I checked the upstream tag/release listing and both v4/v4.1.0 point at a2bbfa2, while this replacement uses b3e506e.... In any workflow run that reaches this step, GitHub will attempt to resolve actions/attest-build-provenance@b3e506e... and fail before provenance is generated; the same bad ref was applied in build-images.yml and integrations-ghcr.yml as well.
Useful? React with 👍 / 👎.
613014c to
ae52cea
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/integrations-ghcr.yml:
- Around line 447-455: Replace the incorrect PEM value being passed into
actions/create-github-app-token: change the `private-key: ${{ env.GH_APP_SEC }}`
input to use the repository secret PEM `private-key: ${{
secrets.GH_APP_PRIVATE_KEY }}` while keeping `app-id: ${{ env.GH_APP_ID }}` and
leaving `GH_APP_SEC` as the OAuth client secret elsewhere; also scan other
workflow files for the same misuse of `GH_APP_SEC` and switch those to
`secrets.GH_APP_PRIVATE_KEY` where a PEM private key is required.
- Around line 677-688: The workflow step "Install Syft (SBOM)" currently
downloads and installs Syft without integrity checks and pins a non-existent
SYFT_VERSION; update SYFT_VERSION to a real release (e.g., v1.44.0) and add a
SYFT_SHA256 variable (or fetch the official checksum file) then verify the
downloaded tarball before extracting and installing: after curl, run a SHA256
verification (e.g., compare SYFT_SHA256 with the downloaded tarball via
sha256sum -c or echo "<SHA> <file>" | sha256sum -c -) and fail the job if the
checksum does not match, only then proceed to tar -xzf and sudo install the syft
binary; ensure the environment variable names SYFT_VERSION and SYFT_SHA256 and
the actions around curl, tar, and sudo install are updated accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4d871e38-56e4-4596-8577-1030d92f4e7f
📒 Files selected for processing (1)
.github/workflows/integrations-ghcr.yml
| if: ${{ env.GH_APP_ID != '' && env.GH_APP_SEC != '' }} | ||
| continue-on-error: true | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | ||
| with: | ||
| client-id: ${{ secrets.GH_APP_CLIENT_ID }} | ||
| private-key: ${{ secrets.GH_APP_SEC }} | ||
| app-id: ${{ env.GH_APP_ID }} | ||
| private-key: ${{ env.GH_APP_SEC }} | ||
| # Explicit token scopes required for clone + GHCR push | ||
| permission-contents: read | ||
| permission-packages: write |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if audit script would flag this workflow's private-key usage
rg -n 'private-key:.*GH_APP_SEC' .github/workflows/
# Verify canonical documentation states
fd -t f 'CANONICAL_NAMES.md' --exec cat {}Repository: POWERFULMOVES/PMOVES.AI
Length of output: 12998
Fix GitHub App token private-key to use PEM secret GH_APP_PRIVATE_KEY
.github/workflows/integrations-ghcr.yml passes private-key: ${{ env.GH_APP_SEC }} into actions/create-github-app-token. Repo canonical naming states GH_APP_SEC is the OAuth client secret (NOT a PEM), while private-key must be the PEM secret GH_APP_PRIVATE_KEY (-----BEGIN RSA PRIVATE KEY-----). The same misuse pattern still exists in other workflows.
- Update this workflow to use
secrets.GH_APP_PRIVATE_KEYforprivate-key(and keepGH_APP_SEConly for the OAuth client secret). - Location:
.github/workflows/integrations-ghcr.yml(~lines 447-455)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/integrations-ghcr.yml around lines 447 - 455, Replace the
incorrect PEM value being passed into actions/create-github-app-token: change
the `private-key: ${{ env.GH_APP_SEC }}` input to use the repository secret PEM
`private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}` while keeping `app-id: ${{
env.GH_APP_ID }}` and leaving `GH_APP_SEC` as the OAuth client secret elsewhere;
also scan other workflow files for the same misuse of `GH_APP_SEC` and switch
those to `secrets.GH_APP_PRIVATE_KEY` where a PEM private key is required.
| - name: Install Syft (SBOM) | ||
| if: ${{ steps.cfg.outputs.generate_sbom == 'true' && steps.meta.outputs.has_tags == 'true' }} | ||
| uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 | ||
| env: | ||
| SYFT_VERSION: v1.45.0 | ||
| run: | | ||
| set -euo pipefail | ||
| install_dir="${RUNNER_TEMP}/syft-bin" | ||
| mkdir -p "$install_dir" | ||
| curl -sSfL "https://github.com/anchore/syft/releases/download/${SYFT_VERSION}/syft_${SYFT_VERSION#v}_linux_amd64.tar.gz" -o "${RUNNER_TEMP}/syft.tar.gz" | ||
| tar -xzf "${RUNNER_TEMP}/syft.tar.gz" -C "$install_dir" syft | ||
| sudo install -m 0755 "${install_dir}/syft" /usr/local/bin/syft | ||
| syft version |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the SHA256 checksum for syft 1.45.0 linux amd64?
💡 Result:
As of June 5, 2026, there is no official release for Syft version 1.45.0 in the anchore/syft GitHub repository. The latest available release at that time was v1.44.0 [1][2]. While references to version 1.45.0 appear in external project pipelines [3], an official release page with corresponding checksums for Syft 1.45.0 was not found. [1][4]. For official checksums, always refer directly to the Anchore Syft GitHub release page for the specific version [4].
Citations:
- 1: https://github.com/anchore/syft/releases/tag/v1.44.0
- 2: https://pkg.go.dev/github.com/anchore/syft@v1.44.0
- 3: Bump pipeline from 1.45.0 to 1.46.1 paketo-buildpacks/syft#416
- 4: https://github.com/anchore/syft/releases
Add integrity verification for the Syft download (and fix SYFT_VERSION)
In .github/workflows/integrations-ghcr.yml (Install Syft (SBOM)), the workflow downloads and sudo installs the Syft binary without any checksum/signature verification. Also, SYFT_VERSION: v1.45.0 does not appear to have an official anchore/syft GitHub release/checksums (latest available release found was v1.44.0), so a correct SYFT_SHA256 can’t be sourced for that pinned artifact. Bump to an existing tagged version and verify the downloaded tarball against the official SHA256 checksums before extracting/installing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/integrations-ghcr.yml around lines 677 - 688, The workflow
step "Install Syft (SBOM)" currently downloads and installs Syft without
integrity checks and pins a non-existent SYFT_VERSION; update SYFT_VERSION to a
real release (e.g., v1.44.0) and add a SYFT_SHA256 variable (or fetch the
official checksum file) then verify the downloaded tarball before extracting and
installing: after curl, run a SHA256 verification (e.g., compare SYFT_SHA256
with the downloaded tarball via sha256sum -c or echo "<SHA> <file>" | sha256sum
-c -) and fail the job if the checksum does not match, only then proceed to tar
-xzf and sudo install the syft binary; ensure the environment variable names
SYFT_VERSION and SYFT_SHA256 and the actions around curl, tar, and sudo install
are updated accordingly.
…weep /tmp SBOM scratch (#1717) #1715 restored the GHCR workflow startup (pinned attest-build-provenance) and added a `cleanup-self-hosted-runners` job, but introduced two issues: 1. Deadlock: the cleanup matrix `[kvm4, kvm2]` references a `kvm2` runner label that does not exist (both VPS runners are labelled `kvm4`). Because `build-publish` `needs: cleanup-self-hosted-runners`, the unschedulable `kvm2` leg leaves the job permanently queued and blocks every push-triggered publish (run 27020807888). Fix: matrix -> `[kvm4]`. 2. Blind spot: the cleanup prunes Docker + `_work`, but the 2026-06-05 KVM4-1 disk-full incident was 126G of orphaned Syft/stereoscope SBOM extractions in `/tmp` — invisible to `docker system prune`. Add an explicit `/tmp` sweep of stereoscope-*/sbom-action-*/ codeql-* older than a day (active scans are minutes old, untouched). Complements the node-side /etc/tmpfiles.d aging rule placed on KVM4-1. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2 participants
Summary
Validation