ci: attest umbrella chart provenance; advance backend images to attested tags by mitasovr · Pull Request #1298 · constructorfabric/insight

mitasovr · 2026-06-11T14:08:03Z

Summary

Follow-up to #1280 closing the two remaining provenance gaps.

1. Umbrella chart attestation

publish-chart now parses the chart's OCI digest from helm push output and attests it with actions/attest-build-provenance@v2 (push-to-registry: true) — the same keyless SLSA contract as the container images:

gh attestation verify oci://ghcr.io/constructorfabric/charts/insight:<version> \
  --repo constructorfabric/insight

2. Backend images: chart pins predate attestation

The chart currently pins all three backend services (api-gateway, analytics-api, identity) to 2026.06.09.10.55-9ef2224 — built before the attestation steps landed, so gh attestation verify fails for every chart-referenced backend image. The attested rebuilds from #1280 were never promoted into the chart: bump-descriptors committed in that run (which skips publish-chart), and the follow-up run no longer matched the backend path filters.

Rebuild markers in the three service Dockerfiles make the merge of this PR rebuild + attest all three images; publish-chart then advances their appVersions and publishes an umbrella whose pinned backend tags are all attested — and the chart artifact itself now carries provenance too.

Expected CI flow on merge (single run)

changes flags all three backend services → rebuild + push + attest ×3 → connector matrix empty → bump-descriptors skipped → publish-chart runs in the same run: bumps three subchart appVersions, patch-bumps umbrella, pushes the chart, attests the chart digest.

Known-red check

Run E2E suite is red on every PR (pre-existing cost_cents migration mismatch on the e2e rig) — unrelated, tracked separately.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Enhanced CI/CD pipeline to capture and validate artifact metadata during chart publishing.
- Updated Docker image build configurations to support improved artifact tracking and provenance.

…ted tags publish-chart now captures the chart OCI digest from helm push output and runs actions/attest-build-provenance@v2 on it (push-to-registry: true), giving the umbrella chart the same keyless SLSA provenance contract as the container images. Verify: gh attestation verify oci://ghcr.io/constructorfabric/charts/insight:<ver> \ --repo constructorfabric/insight Also add rebuild markers to the three backend service Dockerfiles. The chart currently pins all backend appVersions to a tag built before the attestation steps landed, so those referenced images carry no provenance (the attested rebuilds from the attestation PR were never promoted into the chart: bump-descriptors committed in that run, which skips publish-chart, and the follow-up run no longer matched the backend path filters). Merging this PR rebuilds and attests all three services and publishes an umbrella whose pinned backend tags are all attested. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Roman Mitasov <Roman.Mitasov@constructor.tech>

coderabbitai · 2026-06-11T14:08:20Z

📝 Walkthrough

Walkthrough

This PR enhances the container image publishing pipeline to include SLSA provenance attestation. The workflow now extracts OCI digests from published Helm charts and creates keyless provenance attestations. Dockerfile rebuild markers are added to signal that container images should be republished to align with the new attestation capability.

Changes

SLSA Provenance for Published Chart

Layer / File(s)	Summary
Helm push digest extraction and provenance attestation `.github/workflows/build-images.yml`	The helm push step now captures output, extracts the OCI digest, and emits it as a workflow output. A new provenance attestation step immediately follows, using `actions/attest-build-provenance@v2` to bind keyless SLSA provenance to the extracted digest and push it to the registry.
Container service Dockerfile rebuild markers `src/backend/services/analytics-api/Dockerfile`, `src/backend/services/api-gateway/Dockerfile`, `src/backend/services/identity/Dockerfile`	Rebuild marker comment blocks added to the top of each service Dockerfile to indicate that container images should be republished so chart-pinned tags advance to SLSA-attested versions.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A hop through provenance, said the swift rabbit,
Where digests are parsed and attestations inhabit,
SLSA marks the way, from the Helm to the chart,
Each service renewed, from the finish to start! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the two main changes: adding SLSA provenance attestation to the umbrella chart and rebuilding backend images to get attested tags.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (1)

.github/workflows/build-images.yml (1)
808-808: 💤 Low value

Consider pinning the attestation action to a commit SHA.

The workflow uses actions/attest-build-provenance@v2, which is a moving tag. For supply chain security, consider pinning to a specific commit SHA (e.g., actions/attest-build-provenance@<commit-sha> # v2.x.x).

This would align with the existing practice for docker/build-push-action at lines 206, 252, 295, 352, 393, and 440, where commit SHAs are used.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-images.yml at line 808, The workflow uses the moving
tag actions/attest-build-provenance@v2; replace that with a pinned commit SHA
(e.g., actions/attest-build-provenance@<commit-sha> # v2.x.x) to avoid using a
mutable tag—update the step referencing actions/attest-build-provenance@v2 to
the specific commit SHA and add an inline comment with the corresponding v2.x.x
version for clarity and consistency with the other pinned actions.
Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/build-images.yml:
- Line 808: The workflow uses the moving tag actions/attest-build-provenance@v2;
replace that with a pinned commit SHA (e.g.,
actions/attest-build-provenance@<commit-sha> # v2.x.x) to avoid using a mutable
tag—update the step referencing actions/attest-build-provenance@v2 to the
specific commit SHA and add an inline comment with the corresponding v2.x.x
version for clarity and consistency with the other pinned actions.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 54727ec4-8f02-46e6-bb41-8bdd0b1b5d4f

📥 Commits

Reviewing files that changed from the base of the PR and between 06e5bff and b8902c0.

📒 Files selected for processing (4)

.github/workflows/build-images.yml
src/backend/services/analytics-api/Dockerfile
src/backend/services/api-gateway/Dockerfile
src/backend/services/identity/Dockerfile

…ort errors (#1300) The "Attest chart provenance" step added in #1298 failed on main with "No credentials found for registry ghcr.io": helm registry login writes to helm's own config, while attest-build-provenance (push-to-registry: true) reads Docker credentials. Add docker/login-action to publish-chart before the attest step, mirroring the image jobs. Because that failure aborted publish-chart before "Commit version bumps back to main", the appVersion bumps from the attested backend rebuilds were lost (chart 0.1.53 was pushed unattested; main still pins the pre-attestation backend tags). Refresh the rebuild markers in the three backend Dockerfiles so the merge of this PR rebuilds + attests the services again and publish-chart re-publishes the umbrella with attested pins — and this time attests and commits back. Also set ignore-error=true on every cache-to: type=gha export: the GitHub Actions cache backend produced three spurious job failures in three days (504 on toolbox, not_found on jira-enrich, 504 on analytics-api). Cache export is an optimization — by that point the image is already built and pushed; a flaky cache service must not fail the job or block chart publication. cache-from already tolerates an unavailable cache. Signed-off-by: Roman Mitasov <Roman.Mitasov@constructor.tech> Co-authored-by: Roman Mitasov <Roman.Mitasov@constructor.tech> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

coderabbitai Bot reviewed Jun 11, 2026

View reviewed changes

mitasovr merged commit cb61d6a into constructorfabric:main Jun 11, 2026
12 checks passed

mitasovr mentioned this pull request Jun 11, 2026

fix(ci): registry login for chart attestation; tolerate gha cache export errors #1300

Merged

coderabbitai Bot mentioned this pull request Jun 23, 2026

Fix local deploy and pin new version #1454

Merged

This was referenced Jul 8, 2026

fix(analytics): re-trigger chart publish for the unified-metrics image #1684

Merged

feat(authenticator): OIDC login + sessions + cookie-to-JWT exchange (nginx+auth step 04) #1686

Merged

This was referenced Jul 22, 2026

fix(ci): publish the gateway image + bump authenticator/gateway subchart appVersions #1838

Merged

ci: pin backend appVersions in bump-descriptors too (fix manual rebuild) #1894

Merged

Navigation Menu

Uh oh!

ci: attest umbrella chart provenance; advance backend images to attested tags - #1298

ci: attest umbrella chart provenance; advance backend images to attested tags#1298
mitasovr merged 1 commit into
constructorfabric:mainfrom
mitasovr:chore/attest-umbrella-chart-and-backend

mitasovr commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

mitasovr commented Jun 11, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

1. Umbrella chart attestation

2. Backend images: chart pins predate attestation

Expected CI flow on merge (single run)

Known-red check

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

mitasovr commented Jun 11, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading