Skip to content

Add build workflow for metering-test-adapter image #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
omer-vishlitzky merged 1 commit into from
Aug 6, 2026
Merged

Add build workflow for metering-test-adapter image #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 77 additions & 0 deletions .github/workflows/build-metering-test-adapter-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
name: Build metering-test-adapter image

on:
workflow_dispatch:
pull_request:
paths:
- 'osac-metering/metering-service/**'
- '!osac-metering/metering-service/**/*.md'
push:
branches:
- main
tags:
- 'osac-metering/v*'

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
REGISTRY: ghcr.io
IMAGE_NAME: osac-project/metering-test-adapter

jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

steps:
- name: Checkout repository
uses: actions/checkout@v7
Comment on lines +31 to +32

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file=".github/workflows/build-metering-test-adapter-image.yaml"

echo "== file exists =="
test -f "$file" && echo yes || echo no

echo "== workflow excerpts =="
if test -f "$file"; then
  nl -ba "$file" | sed -n '1,220p'
fi

echo "== checkout occurrences in workflow =="
rg -n "actions/checkout|persist-credentials|GITHUB_TOKEN|docker login|podman login|GHCR|ghcr|registry" "$file" || true

Repository: osac-project/osac

Length of output: 242

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file=".github/workflows/build-metering-test-adapter-image.yaml"

echo "== workflow excerpts =="
awk '{printf "%6u  %s\n", NR, $0}' "$file" | sed -n '1,220p'

echo
echo "== checkout occurrences in workflow =="
grep -nE "actions/checkout|persist-credentials|GITHUB_TOKEN|docker login|podman login|GHCR|ghcr|registry" "$file" || true

Repository: osac-project/osac

Length of output: 3788

Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials

Disable checkout credential persistence.

actions/checkout@v7 stores GITHUB_TOKEN in local Git config by default. No later step performs Git operations; registry push credentials come from the separate login step, so no other credential is required. Set with: persist-credentials: false.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 31-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-metering-test-adapter-image.yaml around lines 31 -
32, Update the “Checkout repository” step using actions/checkout@v7 to set
persist-credentials to false in its with configuration, while leaving the
existing checkout behavior unchanged.

Source: Linters/SAST tools


- name: Log into registry ${{ env.REGISTRY }}
if: github.event_name != 'pull_request'
uses: docker/login-action@v4
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Compute release version
if: startsWith(github.ref, 'refs/tags/osac-metering/')
run: |
version="${GITHUB_REF_NAME#osac-metering/}"
semver_re='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*)|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(\.((0|[1-9][0-9]*)|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*)?$'
if ! [[ "${version}" =~ ${semver_re} ]]; then
echo "::error::Tag '${GITHUB_REF_NAME}' is not a valid semver release tag"
exit 1
fi
core="${version%%-*}"
echo "RELEASE_VERSION=${version}" >> "$GITHUB_ENV"
echo "RELEASE_MAJOR_MINOR=${core%.*}" >> "$GITHUB_ENV"
echo "RELEASE_MAJOR=${core%%.*}" >> "$GITHUB_ENV"

- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v6
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=raw,value=${{ env.RELEASE_VERSION }},enable=${{ env.RELEASE_VERSION != '' }}
type=raw,value=${{ env.RELEASE_MAJOR_MINOR }},enable=${{ env.RELEASE_VERSION != '' }}
type=raw,value=${{ env.RELEASE_MAJOR }},enable=${{ env.RELEASE_VERSION != '' }}
type=ref,event=branch
type=ref,event=pr
type=sha
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}

- name: Build and push Docker image
uses: docker/build-push-action@v7
with:
context: osac-metering/metering-service
file: osac-metering/metering-service/Containerfile.test-adapter
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
Comment on lines +70 to +77

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow header and relevant sections =="
cat -n .github/workflows/build-metering-test-adapter-image.yaml | sed -n '1,140p'

echo
echo "== occurrences of github-token permissions, id-token, cosign/Sigstore, docker/build-push and push outputs =="
rg -n "permissions:|id-token:|GITHUB_TOKEN|cosign|sigstore|docker/build-push-action|docker/build-push-action@|build:|outputs:|digest|ghcr|push:" .github/workflows/build-metering-test-adapter-image.yaml

Repository: osac-project/osac

Length of output: 3815

Security Misconfiguration (CWE-345)

Reachability: External

Sign each published image digest.

This workflow publishes GHCR images without a Sigstore or cosign signature. Add a push-only signing step for steps.build.outputs.digest, and grant id-token: write only to the publishing job.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-metering-test-adapter-image.yaml around lines 70 -
77, Update the publishing job containing the “Build and push Docker image” step
to grant `id-token: write` in its permissions, limited to that job. Expose the
build digest via the action step’s `id` and add a subsequent step that runs only
when `push` is enabled, signing `steps.build.outputs.digest` with the
repository’s established Sigstore/cosign tooling.

Source: Path instructions

2 changes: 1 addition & 1 deletion .github/workflows/e2e-vmaas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ jobs:
# override mechanism keys strictly off imageKey, one build per key, so this
# is the only way to get both fields covered without changing that mechanism
# (which lives in osac-test-infra, not here). See OSAC-3546.
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","context":".","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","context":".","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.configAsCode.eeImage","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","context":".","imageKey":"bmf.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-metering/metering-service/Containerfile","imageKey":"metering.image.repository"}]'
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","context":".","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","context":".","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.configAsCode.eeImage","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","context":".","imageKey":"bmf.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-metering/metering-service/Containerfile","imageKey":"metering.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-metering/metering-service/Containerfile.test-adapter","imageKey":"metering.testAdapter.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
fork-pr-author-association: ${{ github.event.pull_request.head.repo.fork && github.event.pull_request.author_association || '' }}
fork-pr-author: ${{ github.event.pull_request.head.repo.fork && github.event.pull_request.user.login || '' }}
Expand Down
Loading