fixes docker manifest script for hardenend runner

[akshaydeo]

Summary

Fixes intermittent Docker registry connectivity issues in the release pipeline and hardens the Docker manifest shell scripts.

Changes

• Added production.cloudfront.docker.com:443 to the allowed egress hosts in the release pipeline workflow, alongside the existing production.cloudflare.docker.com:443 entry, to ensure Docker registry pulls succeed regardless of which CDN endpoint is used.
• Added #!/usr/bin/env bash shebang and set -euo pipefail to both create-docker-manifest.sh and create-docker-manifest-ubi9.sh so the scripts fail fast on errors, unset variables, or pipeline failures.
• Quoted all variable expansions in both manifest scripts to prevent word splitting and globbing issues.
• Switched jq -r to jq -er so that jq exits with a non-zero status if the extracted digest value is null or empty, preventing silent failures when building manifests.
• Added a trailing newline to create-docker-manifest.sh.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Trigger a release pipeline run and verify that Docker manifest creation completes successfully for both standard and UBI9 images across amd64 and arm64 platforms.

Breaking changes

• Yes
• No

Related issues

Security considerations

No security implications. Changes are limited to CI workflow egress rules and shell script robustness.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6d500f48-9f57-4c7f-aa0e-c6ad36ae3a66

📥 Commits

Reviewing files that changed from the base of the PR and between 3af6d9c and a8196b3.

📒 Files selected for processing (3)

• .github/workflows/release-pipeline.yml
• .github/workflows/scripts/create-docker-manifest-ubi9.sh
• .github/workflows/scripts/create-docker-manifest.sh

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Enhanced release pipeline reliability and security by strengthening Docker manifest creation scripts with improved error handling and network allowlist configuration.

Walkthrough

The release pipeline hardening updates egress allowlists to permit CloudFront access in both Docker manifest jobs, and refactors both manifest creation scripts with Bash strict mode, jq-based digest parsing, and quoted variable references.

Changes

Docker Manifest Release Pipeline Hardening

Layer / File(s)	Summary
Workflow network egress configuration .github/workflows/release-pipeline.yml	The docker-manifest and docker-manifest-ubi9 job Harden Runner steps each add production.cloudfront.docker.com:443 to allowed-endpoints to enable CloudFront access during release.
Standard Docker manifest script hardening .github/workflows/scripts/create-docker-manifest.sh	Adds Bash shebang and set -euo pipefail, switches digest extraction to jq -er, and quotes image/tag/digest references in all docker manifest create/push commands.
UBI9 Docker manifest script hardening .github/workflows/scripts/create-docker-manifest-ubi9.sh	Adds Bash shebang and set -euo pipefail, refactors digest parsing to use jq -er, and quotes all image/tag/digest references in UBI9 manifest inspect/create/push calls.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• maximhq/bifrost#3772: Both PRs modify .github/workflows/release-pipeline.yml Harden Runner egress allowlists to add production.cloudfront.docker.com:443 for Docker manifest-related jobs.
• maximhq/bifrost#3643: Both PRs modify .github/workflows/release-pipeline.yml to add production.cloudfront.docker.com:443 to the egress allowlist for Docker-image-related runners.

Suggested reviewers

• danpiths

Poem

🐰 Hops through pipelines, scripts now strict and bright,
CloudFront reaches granted, network flows just right,
Bash shebang sparkles, set -e holds the line,
Quoted refs and jq parsing—manifest ops align! ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-27-fixes_docker_manifest_script_for_hardenend_runner

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[akshaydeo]

• fixes docker manifest script for hardenend runner #3784 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[akshaydeo]

Merge activity

• May 26, 10:53 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 26, 10:54 PM UTC: @akshaydeo merged this pull request with Graphite.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — all changes are additive CI hardening fixes with no impact on application code.

The scripts now fail fast on bad digests instead of silently pushing a broken manifest, and the missing CloudFront endpoint unblocks Docker Hub pushes under the hardened runner. Both changes are straightforward and correct.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/scripts/create-docker-manifest.sh	Added shebang, set -euo pipefail, proper variable quoting, and jq -er for fail-fast digest extraction
.github/workflows/scripts/create-docker-manifest-ubi9.sh	Same hardening applied as the non-UBI9 script: shebang, strict mode, quoting, and jq -er
.github/workflows/release-pipeline.yml	Adds production.cloudfront.docker.com:443 to the egress allowlist for both docker-manifest and docker-manifest-ubi9 harden-runner steps

_{Reviews (1): Last reviewed commit: "fixes docker manifest script for hardene..." | Re-trigger Greptile}