fix(ci): stabilize integrations GHCR (disk, digest signing, platforms)

[POWERFULMOVES]

Follow-up to get integrations GHCR green on main.

• Adds runner disk cleanup to prevent buildx failures (ENOSPC).
• Moves cosign sign/verify to GHCR digest refs and verifies identity via GITHUB_WORKFLOW_REF.
• Allows per-integration platform overrides (amd64-only for heavy builds that consistently fail under QEMU).
• Expands Archon UI Trivy ignore list (follow-up: bump upstream npm/go deps in PMOVES-Archon).
• Updates SupaSerch deps + lock to address Starlette CVE-2024-47874.

Summary by CodeRabbit

• Security

  • Implemented hash verification for package installations
  • Applied security-focused version constraints to dependencies
  • Updated CVE ignore list

• Infrastructure

  • Added multi-architecture platform support for container builds
  • Optimized build environment with automated cleanup routines
  • Updated signing and verification processes for container images

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Updates the Trivy vulnerability ignore list with new CVE identifiers, refactors the integrations CI/CD workflow to support multi-architecture builds with digest-based Cosign signing and verification, and reorganizes the supaserch service dependencies to use hash-verified requirements with explicit version constraints including security patches.

Changes

Cohort / File(s)	Summary
Security Exceptions .github/trivy/archon-ui.trivyignore	Added nine CVE identifiers (CVE-2024-21538, CVE-2025-7783, CVE-2025-64756, CVE-2024-24790, CVE-2023-45288, CVE-2024-34156, CVE-2025-47907) to the Trivy ignore list.
CI/CD Workflow .github/workflows/integrations-ghcr.yml	Added multi-architecture platform specifications (linux/amd64, linux/arm64) to build matrix entries; introduced runner disk cleanup step; updated Build and push step to use per-matrix platform configurations; refactored Cosign sign and verify steps to operate on image digests (IMAGE_DIGEST_REF) instead of tags, including updated certificate identity logic.
Dependency Management pmoves/services/supaserch/Dockerfile, pmoves/services/supaserch/requirements.txt	Updated Dockerfile to use --require-hashes with requirements.lock for hash-verified dependency installation; replaced requirements.lock inclusion in requirements.txt with explicit inline package entries (fastapi, httpx, nats-py, prometheus-client, python-dotenv, pyyaml, uvicorn[standard]) and added Starlette version constraint (>=0.40.0) to address CVE-2024-47874.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• .github/workflows/integrations-ghcr.yml: Requires careful verification of multi-architecture build matrix configuration, digest-based Cosign operations, and environment variable handling (IMAGE_DIGEST_REF computation and certificate identity logic).
• pmoves/services/supaserch/requirements.txt: Verify all explicit versions are compatible and that CVE-2024-47874 is properly addressed by the Starlette constraint.
• pmoves/services/supaserch/Dockerfile: Confirm the hash verification file (requirements.lock) exists and is properly maintained.

Possibly related PRs

• fix(ci): make integrations GHCR workflow green #306: Overlapping changes to .github/workflows/integrations-ghcr.yml with build matrix and Cosign signing/verification step modifications.

Poem

🐰 Multi-arch builds hop through the night,
With digests signed and hashes tight,
CVEs vanquished, requirements squared,
The supaserch service, secured and cared! 🔐

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch fix/ghcr-green-v2

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e2a19c7 and cc50850.

⛔ Files ignored due to path filters (1)

• pmoves/services/supaserch/requirements.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/trivy/archon-ui.trivyignore (1 hunks)
• .github/workflows/integrations-ghcr.yml (14 hunks)
• pmoves/services/supaserch/Dockerfile (1 hunks)
• pmoves/services/supaserch/requirements.txt (1 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}