chore: migrate GHCR/repo refs to constructorfabric; attest published images; republish connector images - #1280
Merged
mitasovr merged 2 commits intoJun 10, 2026
Conversation
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR renames repository and GHCR references from cyberfabric/* to constructorfabric/* across environment examples, connector descriptors, Dockerfiles, deployment/docs, ADRs/PRDs, and updates the image-build CI workflow to emit SLSA provenance attestations. ChangesOrganizational Reference Migration
Sequence Diagram (build + attest flow) sequenceDiagram
participant ActionsRunner as GitHub Actions
participant BuildStep as docker/build-push-action
participant GHCR as ghcr.io (Registry)
participant Attestor as actions/attest-build-provenance
ActionsRunner->>BuildStep: run build/push (id: build / id: push)
BuildStep->>GHCR: push image -> returns digest
ActionsRunner->>Attestor: invoke attest step (subject-name + digest)
Attestor->>GHCR: publish provenance attestation (referrers)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/domain/metric-catalog/specs/PRD.md`:
- Line 461: The PRD currently gives conflicting guidance about whether consumers
should key off id (UUIDv7) or metric_key; unify the document to make id the
single canonical lookup key everywhere: update all sections that say "lookup by
metric_key" to instead instruct consumers to use id (UUIDv7) as the stable wire
identifier, keep metric_key only as the additional FE-bridge identifier per
ADR-002 (mentioning it is surfaced but not primary), and ensure examples,
response-shape definitions, and any references in links/metric_query_catalog
guidance reflect id-as-primary; also add a short note where metric_key appears
explaining its transitional purpose and that consumers must map metric_key→id if
they currently rely on metric_key.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 78ec5859-725f-40b6-9eed-3f2effc8c9a8
📥 Commits
Reviewing files that changed from the base of the PR and between cf3685e and 9bda5914323db22983adb953e80adaa1841873ad.
📒 Files selected for processing (51)
.env.local.example.env.virtuozzo.exampleDEVLOG.mdREADME.mdcharts/insight/README.mdcharts/insight/templates/NOTES.txtcypilot/.core/skills/connector/workflows/deploy.mdcypilot/.core/skills/connector/workflows/workflow.mddeploy/airbyte/README.mddocs/components/airbyte-toolkit/specs/ADR/0011-cdk-prebuilt-images.mddocs/components/airbyte-toolkit/specs/AIRBYTE-DEPLOY-NOTES.mddocs/components/airbyte-toolkit/specs/DESIGN.mddocs/components/airbyte-toolkit/specs/PRD.mddocs/components/airbyte-toolkit/specs/feature-reconcile/FEATURE.mddocs/components/backend/identity-resolution/identity/specs/ADR/0009-post-profile-with-uniqueness-invariant.mddocs/components/backend/identity-resolution/identity/specs/ADR/0010-org-chart-cache.mddocs/components/backend/identity-resolution/identity/specs/ADR/0011-persons-relax-uniqueness-and-collation.mddocs/components/backend/identity-resolution/identity/specs/PRD.mddocs/components/connectors/ai/github-copilot/specs/DESIGN.mddocs/components/connectors/task-tracking/silver/jira/specs/DESIGN.mddocs/components/connectors/task-tracking/youtrack/specs/README.mddocs/components/deployment/gitops/README.mddocs/components/deployment/specs/ADR/0001-chart-publishing-on-merge.mddocs/components/deployment/specs/DESIGN.mddocs/components/deployment/specs/PRD.mddocs/components/deployment/specs/sop/connector-image-rebuild.mddocs/deploy/README.mddocs/domain/ingestion/specs/DESIGN.mddocs/domain/metric-catalog/specs/ADR/ADR-002-metric-key-on-wire-for-fe-bridge.mddocs/domain/metric-catalog/specs/ADR/ADR-003-link-map-on-catalog-read-response.mddocs/domain/metric-catalog/specs/DESIGN.mddocs/domain/metric-catalog/specs/PRD.mddocs/domain/metric-catalog/specs/PRD_human_readable.mdsrc/backend/services/analytics-api/src/domain/catalog/response.rssrc/backend/services/analytics-api/src/migration/m20260527_000001_seed_metric_catalog.rssrc/backend/services/analytics-api/src/migration/m20260601_000001_ai_claude_team_metrics.rssrc/backend/services/analytics-api/src/migration/m20260601_000002_seed_claude_team_metrics_catalog.rssrc/backend/services/analytics-api/src/migration/m20260603_000001_seed_crm_metric_catalog.rssrc/backend/services/identity/src/Insight.Identity.Infrastructure/MariaDb/Sql.OrgChart.cssrc/backend/services/identity/src/Insight.Identity.Infrastructure/MariaDb/Sql.Profiles.cssrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/ActiveIntervalsTests.cssrc/backend/services/identity/tests/Insight.Identity.Tests.Integration/OrgChartTests.cssrc/ingestion/README.mdsrc/ingestion/connectors/ai/claude-enterprise/README.mdsrc/ingestion/connectors/ai/github-copilot/dbt/copilot__ai_org_usage.sqlsrc/ingestion/connectors/ai/github-copilot/descriptor.yamlsrc/ingestion/connectors/crm/hubspot/descriptor.yamlsrc/ingestion/connectors/crm/salesforce/descriptor.yamlsrc/ingestion/connectors/git/bitbucket-cloud/descriptor.yamlsrc/ingestion/connectors/git/github-v2/descriptor.yamlsrc/ingestion/connectors/task-tracking/jira/descriptor.yaml
cyberantonz
approved these changes
Jun 10, 2026
…fabric
The GitHub org/repo was renamed cyberfabric/cyber-insight -> constructorfabric/insight.
This rewrites all in-scope references to the new org and registry namespace:
- GitHub repo URLs and #NNN shorthand: github.com/cyberfabric/{cyber-insight,insight}
-> constructorfabric/insight; frontend refs -> constructorfabric/insight-front.
- Container images and charts: ghcr.io/cyberfabric/... and
oci://ghcr.io/cyberfabric/charts/... -> ghcr.io/constructorfabric/...
(6 connector descriptors, charts values toolboxImage, jira-enrich, .env examples, docs).
Deliberately left unchanged (not repo/image references):
- the live K8s annotation namespace insight.cyberfabric.com/* (cluster contract),
- the cyberfabric / cyberfabric-core framework name and other repos (DNA, cyber-pilot),
- cypilot traceability IDs, docs.cyberfabric.com / cyberfabric.{io,local,internal} domains,
- kubeconfig / cluster names such as cyber-insight-k8s.
CI (.github/workflows/build-images.yml) was already on IMAGE_PREFIX ghcr.io/constructorfabric;
reconcile-connectors is registry-agnostic (reads the full image ref from the descriptor),
so no workflow or reconcile changes are required.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Roman Mitasov <Roman.Mitasov@constructor.tech>
…rebuilds Add keyless SLSA provenance (actions/attest-build-provenance@v2) to every image-publishing job in build-images.yml: backend-api-gateway, backend-analytics-api, backend-identity, toolbox, and the descriptor-driven build-image matrix. Attestations are signed via the workflow's short-lived OIDC identity (no stored keys; permissions: id-token + attestations) and pushed to GHCR as OCI referrers (push-to-registry: true) so registry-only consumers (cluster admission) can verify without GitHub API access: gh attestation verify oci://<image> --repo constructorfabric/insight Steps are gated to non-PR runs on main, mirroring the image push condition. Also add a rebuild marker comment to all six connector image build contexts (5 CDK Dockerfiles + jira enrich). GHCR packages did not follow the cyberfabric -> constructorfabric org rename, so the descriptor-pinned tags do not resolve under the new namespace. descriptor.yaml is excluded from CI image triggers by design (bump-commit loop break), so a context change is the canonical way (per the connector-image-rebuild SOP) to make the merge of this PR rebuild and republish every connector image: CI builds + attests all six, bump-descriptors patches images.<key>.image with the fresh tag and minor-bumps descriptor.version, and the follow-up run rebakes the toolbox and publishes the umbrella chart. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Roman Mitasov <Roman.Mitasov@constructor.tech>
mitasovr
force-pushed
the
claude/xenodochial-kepler-87e9f7
branch
from
June 10, 2026 11:43
9bda591 to
803b957
Compare
mitasovr
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three related changes, one merge:
1. Org-rename reference migration
The GitHub org/repo was renamed
cyberfabric/cyber-insight→constructorfabric/insight.#NNNshorthand:github.com/cyberfabric/{cyber-insight,insight}→constructorfabric/insight; frontend refs →constructorfabric/insight-front.ghcr.io/cyberfabric/...andoci://ghcr.io/cyberfabric/charts/...→ghcr.io/constructorfabric/...— 6 connector descriptors,charts/insight/values.yamltoolboxImage,insight-jira-enrich,.env.*.example, docs. Image tags preserved 1:1.Deliberately left unchanged (not repo/image references): the live K8s annotation namespace
insight.cyberfabric.com/*(cluster contract), thecyberfabric/cyberfabric-coreframework name and other repos (DNA,cyber-pilot*), cypilot traceability IDs,docs.cyberfabric.com/cyberfabric.{io,local,internal}domains, kubeconfig/cluster names (cyber-insight-k8s).2. Keyless build-provenance attestations (SLSA)
Every image-publishing job in
build-images.yml(api-gateway, analytics-api, identity, toolbox, connector matrix) now runsactions/attest-build-provenance@v2after push: signed via the workflow's short-lived OIDC identity (no stored keys), attested by digest, and stored both in the repo attestation store and next to the image in GHCR (push-to-registry: true) so cluster admission can verify without GitHub API access:3. Republish all connector images under the new namespace
GHCR packages did not follow the org rename — the descriptor-pinned tags don't resolve under
ghcr.io/constructorfabric. Rebuild markers in all six connector build contexts (5 CDK Dockerfiles + jira enrich) make the merge of this PR fire the full SOP flow: CI rebuilds + attests all six images,bump-descriptorspatchesimages.<key>.imagewith fresh tags and minor-bumpsdescriptor.version, the follow-up run rebakes the toolbox and publishes the umbrella chart; reconcile then re-registers connectors with the new images.CI / reconcile impact
build-images.ymlwas already onIMAGE_PREFIX: ghcr.io/constructorfabric; descriptors now match it.reconcile-connectorsis registry-agnostic (reads full image refs from descriptors) — no changes needed.Known-red checks (pre-existing, not from this PR)
src/ingestion/scripts/migrations/20260601000000_ai-claude-team-metrics.sqlreferencesc.cost_centsmissing fromsilver.class_ai_dev_usageon the e2e rig (UNKNOWN_IDENTIFIER). Tracked separately.error writing layer blob) — transient; this push re-runs it.🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes